Ssh – How to execute a script on sftp connection

sftpssh

I run an ssh server on my machine and I restrict access to certain users to sftp only with internal-sftp & ChrootDirectory. What I need is a way to execute a script before chrooting users. Actually, the goal is to mount an encrypted filesystem on client connection and unmount it on close.
Thx in advance.

Best Answer

If you don't want to hack the openssh code you have to use the external sftp server. If you do it is a simple matter of putting a wrapper around it. For example: in sshd_config

Subsystem       sftp    /usr/local/bin/sftp-server

In /usr/local/bin/sftp-server:

#!/bin/sh
mount_special_fs
chroot /my/secret/stuff /usr/libexec/openssh/sftp-server
umount_special_fs

It might be possible to put a wrapper around sshd and launch the wrapper from inetd but launching sshd from inted is discouraged because it is to slow to start up.

Related Solutions

Linux – Creating multiple SFTP users for one account

Our solution is to create a main user account for each customer, such as flowershop. Each customer can create an arbitrary number of side accounts with their own passwords, such as flowershop_developer, flowershop_tester, flowershop_dba, etc. This allows them to hand out accounts without sharing their main account password, which is better for a whole bunch of reasons (for example, if they need to remove their DBA's account, they can easily do that without changing their own passwords).

Each one of these accounts is in the flowershop group, with a home folder of /home/flowershop/. SSH uses this as the chroot directory (/home/%u, as shown in the configuration in the question).

We then use ACLs to enable every user in group flowershop to modify all files. When a new customer account is created, we set the ACLs as follows:

setfacl -Rm \
d:group:admin:rwx,d:user:www-data:r-x,d:user:$USERNAME:rwx,d:group:$USERNAME:rwx,\
  group:admin:rwx,  user:www-data:r-x,  user:$USERNAME:rwx,  group:$USERNAME:rwx \
/home/$USERNAME/

This does the following:

Gives group admin (for us, the hosting providers) rwx
Gives user www-data (Apache) r-x to the files*
Gives user $USERNAME rwx to the files
Gives group $USERNAME rwx to the files

This setup appears to be working well for us, but we are open to any suggestions for doing it better.

_{* we use suexec for CGI/PHP running as the customer account}

SSH – SFTP/SCP only + additional command running in background

if the problem you are having is people trying to brute force their way in, try changing the port that your sftp server is on. People generally only spam port 22.

Best Answer

Related Solutions

Linux – Creating multiple SFTP users for one account

SSH – SFTP/SCP only + additional command running in background

Related Topic