| |||||||||||||||||||||||||||||
Download OpenSSH for Linux - A free version of the SSH (Secure Shell) protocol for all GNU/Linux operating systems. The latest stable version of openssh-server available from the Red Hat repositories for RHEL 7 is 7.4p1 and, the latest beta version available from the Red Hat repositories for RHEL 8 is 7.8p1. So if you want to install openssh-server 7.9p1: there is currently one option I'd suggest. You can download the latest stable version 7.9p1 of openssh from the fedora project and install it manually.
- Download openssh-askpass-7.4p1-21.el7.x8664.rpm for CentOS 7 from CentOS repository.
- This is paid Mobile SFTP app which is based on OpenSSH as its backend library.Inspired by opensource community and in the hope of extending usage of OpenSSH on Android devices, the Mobile SFTP was.
Home
The SSH File Transfer Protocol or SFTP is a network protocol providing filetransfer and manipulation functionality over a reliable, encrypted data streamusing SSH version 2. A common misconception is SFTP is simply FTP run over SSH;the truth is SFTP is a new independent protocol designed from the ground up bythe IETF SECSH working group and thusly not compatible with ftp. SFTP serverand its support tools are built into OpenSSH by default.
Purpose:
provide SFTP only access to users (no ssh or scp) restrict users to their home dir (chroot) no libraries or other server support files in users' home dir allow file upload and download access no executable interactive shell access keep maintenance to a minimum when upgrading OpenSSH
The easy way and the hard way
Depending on the version of OpenSSH you have installed depends on how muchwork you need to do to get a secure sftp server setup.
- Use option one(1) if you have OpenBSD v4.3 (OpenBSD v4.2 -current or later). With the latest version of OpenSSH you can setup the sftp server using the ChrootDirectory command in the sshd_config file.
- If you are using a version before the patches to OpenSSH in OpenBSD 4.2 -current then you need to following the instructions in option two(2).
OPTION 1: Install OpenBSD v4.3 (OpenBSD v4.2 -current) or higher with ChrootDirectory
First, make sure you have the ChrootDirectory option in the man page of theopenssh server you are going to use. If the option is not available then youneed to update your version of openssh. If you are using OpenBSD 4.2 -stableyou can always download the -current CVS source tree and build openssh fromthere. If you need assistance setting up the cvs tree take a look at Patching OpenBSD kernel and packages 'howto'.
Next, add the following lines to your sshd_config file. The 'recommendeddirectives' are just good security items you may want to use. The 'sftpdirectives' are what is needed to get the sftp server working.
The new Subsystem called 'internal-sftp' was specifically made by theOpenBSD group for the purpose of chrooting sftp users. The next option will'Match' the user we will call 'ftp' to be forced into the chroot at login. Theorder of loading the Subsystem before the ForceCommand is critical. If youreverse the order you will get errors when sshd tries to start and it willdie.
NOTE: If you are going to allow sftp _only_ logins for the user thenthey DO NOT need a shell. You can add the user and set the shell as/sbin/nologin. When the user logs in with sftp their shell will beinternal-sftp as set by sshd.
Next, you need to setup the directory where the user 'ftp' will be chrooted.For simplicity we are going to make the directory called '/ftp_jail'. For theinternal-sftp server to allow logins, the directory permissions must be setupcorrectly. If not, the sshd server will start, but the 'ftp' user will not beallowed to log in.
Make the '/ftp_jail' directory. Set the ownership as 'chown root:ftp/ftp_jail' and 'chmod 750 /ftp_jail'. The directory will look like this:
This will make a read-only, chrooted directory perfect for people to come inand get stuff, but never write. By changing the permissions on the directoryyou can change the level of access you give to the 'ftp' user. For example, youcould make a directory /ftp_jail/uploads that allow people to write in. Thenyou can moderate what gets copied into the read-only /ftp_jail area. Rememberthat if a user can write in a directory then they can also delete anything inthat directory.
Thats it. All done. If you have any questions please scroll to the bottom ofthis page.
OPTION 2: Install OpenBSD 4.2 or earlier with mount options on the sftp partition
Environment:
OpenBSD v4.2 with OpenSSH v4.7
What needs to be done:
build and install openssh after applying the sftp-server patch build and install the sftpsh shell apply changes to chroot'd, sftp only users
As an added layer of security one can make a partition limiting user options.OpenBSD supplies mount options denying device files, suid calls, and executionof files with the exec bit set on a partition. Apply the following mountoptions 'rw,nodev,nosuid,noexec,softdep' to the partition the chroot'd user'shome directory will exist. Edit the /etc/fstab file and add the options to thepartition sftp will chroot on. For example:
Step 2: getting the OpenSSH source files
Make the directory tree /usr/src/usr.bin/ and change to that directory.Download the latest openssh source tar file from OpenBSD and untar it. Changedirectory in to the ssh directory.
Step 3: patch OpenSSH source with the sftp-server chroot patch
The only change to the openssh source is additional code to the sftp-server.cfile making upgrades to OpenSSH in the future a simple task. The code will lookfor the string '/./' in the home directory path of the user in /etc/passwd. Ifthe string is found the user will be chroot'd to their home directory. Thefollowing file is the patched version of the sftp-server.c file. If you haveopenssh v4.5 or v4.6 you can simply drop this in the source directory'/usr/src/usr.bin/ssh/' replacing the original sftp_server.c file. You canalso download the patched sftp_server.c file and diff it against your owndownloaded version. This way you can look at the proposed changes.
Download the patched file:sftp-server.c
Step 4: build and install OpenSSH
Before building you _may_ want to change the version variable reported by theserver to the client. There is no reason the client needs to know what versionof openssh we are running. To edit the publicly reported version open theversion.h file and change the SSH_VERSION string.
To build openssh change to /usr/src/usr.bin/ssh/ directory and execute thefollowing to make openssh and install the binaries:
Changing the version variable is optional, but highly recommended. Whenyour machine is scanned the first piece of information a bot looks for is theversion number of he ssh server. Do not give out any information that theclient does not explicitly need. The ssh server and client will negotiate finewithout the version number.
Step 5: suid the sftp-server
The user is going to be chroot'd into their home directory so we need toexecute the sftp-server suid. Once the sftp-server is executed the binary willdrop privileges to the chroot'd user. If the sftp-server process is evercompromised, permissions no higher than the chroot'd user could be obtained.
Step 6: build and install the sftpsh shell
The sftpsh shell is the wrapper we will use to deny all connections other thansftp. Sftpsh is the shell the chroot'd user will use when they log in.
Download shell wrapper file: sftpsh.c
Edit sftpsh.c and take a look at the variables at the top of the script.Make sure you set SFTP_BINARY to the proper path where sftp-server is found.Also, you may want to edit the DENY_MESG to something more appropriate for yoursystem. This is the message a remote user will see upon a failed login with sshor scp.
Once sftpsh is built and installed add /bin/sftpsh to /etc/shells so you caneasily apply it to your users.
Step 7: setup the 'sftp only' users
To restrict a user to a the chroot'd sftp only server simply add '/./' to theend of their home directory path and change their shell to /bin/sftpsh. Forexample our 'test' user's home directory and shell are the following accordingto /etc/passwd:
Step 8: testing the server
The openssh server has been patched and the sftpsh shell has been installed.Check the sshd_config file and make sure the line with sftp-server isuncommented. Make sure to shut down sshd and restart it. Sftp to the server withthe user name and password of the user you have chroot'd in /etc/passwd.
You should be able to log in without issue. Now, try to change directory up andout of the home directory. This should fail as the home directory is thechroot'd environment. You can type '?' in the cli to see what commands areallowed. Take a moment to familiarize yourself with what a user can do in theenvironment. Make sure you know what commands are allowed through the sftpclient and whether they will cause your environment any issues. Users can beamazingly destructive even with their own files.
Now try to ssh to the machine and scp a file to/from the machine.
Both ssh and scp should fail and the DENY_MESG string you set in sftpsh shouldhave been displayed and your client immediately disconnected.
Latest Version Of Openssh For Ubuntu
Conclusions
We have built a secure, encrypted file server allowing a user to send andreceive files through sftp only. Ssh and scp are denied to only chroot'dusers. The server will not allow the execution of programs or running of anysystem binaries by the client. As an added bonus we have removed all of theactive/passive port problems associated with standard ftp and ftp though ssl.Sftp will run through firewalls, uses a fully stateful connection scheme andworks over most questionably setup networks.
There are many programs that will allow your users to access the sftp server.OpenSSH by the OpenBSD group supplies a CLI sftp client by default. Windowsusers can use the graphical WinSCP, SshSecureShell or BitKinex or check onssh.com for example. MacOSX users can use the openssh cli or a graphical GUIcalled 'Fugu' which works quit well.
Users wanting to use scripts with sftp should have no problems. For a passwordless environment they will need the use of ssh-keys.For added security it is suggested that you limit the connection rate of sshusers. With pf you can easily limit the connections to 5 connections per 30seconds for example. You can also add an abusive user to a 000033listautomatically with the same stateful tracking options. Check on the main page ofcalomel.org for pf.conf examples and instructions.
Questions
Can I set the umask for sftp users?
Ssh With Username
Setup the 'Match' block for any user in the group 'sftponly' that wil sftpin and ChrootDirectory them into their home directory.
After the user logs in the umask needs to be set. Since you are using theForceCommand directive for internal-sftp you can not use .ssh/rc or.ssh/environment.
So, you can create a new class in login.conf(5) called 'sftponly', specifythe umask= parameter to it and add any user that is going to sftp to thesftponly group in /etc/group .
Can I allow or deny users the use of ssh-keys?
Yes. Since the user is going to be chroot'd in their home directory they canuse the '.ssh/authorized_keys' file. All the user would need to do is make aauthorized_keys file (perms 640) with the keys already inserted. Then the userwould make the '.ssh' directory (perms 700) on the server and upload the'authorized_keys' file in the '.ssh' directory. To deny the use of keys simplymake the '.ssh' directory (perms 700) as root and the user will not be able toaccess it.
Why do you use sftp instead of scp?
Sftp has a limited shell interface like standard ftp. This allows users to login and make changes to the directory structure like making directories andfile removal.
Openssh Downloads
Errors you may encounter:
Latest Version Of Openssl
'Received message too long...' and disconnectionWhen you sftp to the server, the server reports 'Received message too long168660913' and then disconnects. The large number at the end of the error maybe different. This error is reported if the server sends data, commands orerrors to the client when the client is not expecting it or if the binary beingcalled is not executable. During this setup you will see this error if the'SFTP_BINARY' path in the shell 'sftpsh' is not correct. To fix:edit the shell program 'sftpsh.c' set #define SFTP_BINARY '/usr/libexec/sftp-server' to the correct path recompile and install with 'gcc sftpsh.c -o sftpsh;cp sftpsh /bin/sftpsh'
Special thanks to http://www.minstrel.org.uk/ for the for the ftp-server.cpatch.
Questions, comments, or suggestions? Contact Calomel.org