OpenBSD Journal

Ask Undeadly: Can someone help with systrace containment of scp/sftp?

Contributed by merdely on from the go-to-your-room dept.

Pete asks Undeadly:

I'm pretty sure this must be a fairly common requirement: migration from ftp to a secured access file repository. But Google is not too forthcoming.

Has anyone successfully gotten an OpenBSD server running with (a subset of all) user accounts that can only scp/sftp in their /home/directory and no shell access? I'm trying to avoid re-inventing the wheel, so a suitable systrace policy method would be ideal. I've looked at 'scponly', but it's a bit messy and hack-like.

(Comments are closed)

Comments

  1. By Venture37 (venture37) venture37<A>hotmail.com on www.geeklan.co.uk

    not exactly systrace related, but rssh does exactly what you need as far as restrictions go.
    http://dragontoe.org/rssh/

  2. By Venture37 (venture37) venture37<A>hotmail.com on www.geeklan.co.uk

    woops, ignore the comment above

    Currently, it does not work on (at least most of) the *BSDs, nor on OS X. They lack the wordexp() function, which rssh uses for command line argument expansion. Until they have such a function (which is defined by POSIX.2), or until I get bored enough to write a replacement, rssh will not work with the BSDs out of the box.

    Comments

    1. By Francisco de Borja Lopez Rio (wu) wu@e-shell.org on http://www.e-shell.org

      yes it does,i've set it up (in FreeBSD):

      http://wiki.e-shell.org/SSHChrootInFreeBSD

      perhaps with some effort, it will work in OpenBSD too.

  3. By grey (208.80.185.17) on

    You should look into a restricted shell - check out scponly by my friend Joe, it's probably the most recently maintained of the few choices out there:

    http://sublimation.org/scponly/wiki/index.php/Main_Page

  4. By Luiz Gustavo (189.24.40.81) on

    I kept for a few months a bunch of systrace policies updated, but these days time gone away. So far would be difficult, yet you have to take into account that a lots of tests should be done and watch logs for issues.

  5. By Anonymous Coward (85.178.124.242) on

    Well I can't provide a solution either. I gave up nearly 2 years ago as I wanted to solve this on OpenBSD in a sane way. :-/

    If it's allowed to ask another question (I don't know whom to send my question):

    Long ago there where some guys talking about svnd. Other algorithms (then blowfish) and also HW acceleration comes up to my mind.
    I began to re-think about this again as I read about a mail at misc@ from somebody who mentioned HW encryption.

    Also I read about a Bug wich affects svnd-Devices if create fastly many small files (like it's done by a cvs checkout..).

    Is somebody working on improvements for svnd-Devices (HW acceleration, other algorithms)?

    Or does somebody knows a good HW devices to encrypt HDDs (SATA, AES 256Bit prefered (seams nobody supports Twofish so far :/ ) and pls. no EBC mode.

    Thanks for any comment/suggestion! :)

    Comments

    1. By Timo Myyrä (131.177.204.78) on

      > Well I can't provide a solution either. I gave up nearly 2 years ago as I wanted to solve this on OpenBSD in a sane way. :-/
      >
      > If it's allowed to ask another question (I don't know whom to send my question):
      >
      > Long ago there where some guys talking about svnd. Other algorithms (then blowfish) and also HW acceleration comes up to my mind.
      > I began to re-think about this again as I read about a mail at misc@ from somebody who mentioned HW encryption.
      >
      > Also I read about a Bug wich affects svnd-Devices if create fastly many small files (like it's done by a cvs checkout..).
      >
      > Is somebody working on improvements for svnd-Devices (HW acceleration, other algorithms)?
      >
      > Or does somebody knows a good HW devices to encrypt HDDs (SATA, AES 256Bit prefered (seams nobody supports Twofish so far :/ ) and pls. no EBC mode.
      >
      > Thanks for any comment/suggestion! :)


      Not sure if this is relevant but there was a presentation about Soft RAID by Ted Unangst at OpenCON. He talked about the coming improvements to the Soft RAID which at later stages would allow disks to be encrypted easily. Svnd was also mentioned but I don't remember the details that well. I doubt Ted is working on the algorithms but he might know if there's work going on in the disk encryption arena.

  6. By Someone else (129.128.29.241) on

    I don't see the point to systrace...

    echo "nogo:*:9919:someuser" >> /etc/group
    cd /
    chmod g-a *
    chgrp nogo *
    mkdir /restricted_dir
    chmod g+rx / /restricted_dir
    mkdir /restricted_dir/someuser_home

    Add someuser with appropriate home.

    Done.

    Comments

    1. By Someone (203.129.238.212) on

      Makes great sense. Simple solutions are better in long run.
      Let us rely on the underlying fundamental mechanisms first
      and move on further if something more sophisticated is needed.

  7. By Aurel26 (82.224.117.175) aurelien26@free.fr on

    1. Create an user account (example: marc) with a homedir (/home/marc)

    2. Restrict sftp for this account. Add in file /etc/ssh/sshd_config:
    Match User marc
    ForceCommand /usr/libexec/sftp-server

    3. Create a systrace policy for this user (I posted an example http://aurelien26.free.fr/usr_libexec_sftp_server)

    4. Place this policy in the default location with corrects rights
    -r--r--r-- 1 root wheel /home/marc/.systrace/usr_libexec_sftp_server
    (users must not be able to change this file)

    5. Use systrace for sftp with this user (change ForceCommand in etc/ssh/sshd_config):
    Match User marc
    ForceCommand /bin/systrace -i -a /usr/libexec/sftp-server

    6. It's can be be usefull to create a log file to see all policy violations:
    ForceCommand /bin/systrace -i -E /home/systrace_logs -a /usr/libexec/sftp-server



    Comments

    1. By Peter (88.162.130.192) on

      There is a project which can do what you want, it is called MySecureShell. There is a lot of other features like MD5 checksum with WinSCP...

      http://mysecureshell.sourceforge.net

      Good luck :-)

    2. By Paul Irofti (bulibuta) bulibuta@gmail.com on

      > 1. Create an user account (example: marc) with a homedir (/home/marc)
      >
      > 2. Restrict sftp for this account. Add in file /etc/ssh/sshd_config:
      > Match User marc
      > ForceCommand /usr/libexec/sftp-server
      >
      > 3. Create a systrace policy for this user (I posted an example http://aurelien26.free.fr/usr_libexec_sftp_server)
      You're missing mquery and fsread for /usr/lib. ^^

  8. By Peter (88.162.130.192) on

    There is a project which can do what you want, it is called MySecureShell. There is a lot of other features like MD5 checksum with WinSCP...

    http://mysecureshell.sourceforge.net

    Good luck :-)

    Comments

    1. By Anonymous Coward (24.37.242.64) on

      > There is a project which can do what you want, it is called MySecureShell. There is a lot of other features like MD5 checksum with WinSCP...
      >
      > http://mysecureshell.sourceforge.net
      >
      > Good luck :-)

      Nice artwork for the logo, but why squish the blowfish when it's related to OpenSSH?

      Comments

      1. By Johan M:son Lindman (jl) on

        > > There is a project which can do what you want, it is called MySecureShell. There is a lot of other features like MD5 checksum with WinSCP...
        > >
        > > http://mysecureshell.sourceforge.net
        > >
        > > Good luck :-)
        >
        > Nice artwork for the logo, but why squish the blowfish when it's related to OpenSSH?
        >

        Because that is what linux zealot numb nuts do.
        Just disregard it.

      2. By Cat (62.56.93.198) on

        > > http://mysecureshell.sourceforge.net
        > Nice artwork for the logo, but why squish the blowfish when
        > it's related to OpenSSH?

        Looks like the blowfish are being held as if they were guns or weapons of some type - in http://mysecureshell.sourceforge.net/logos/mss_03.png they appear to be strapped to the penguin's back.

        I think the squishing's unintentional ...

  9. By Kristaps Dzonsons (2001:6b0:1:1dd0:21a:a0ff:fe40:dd92) kristaps@kth.se on http://mult.bsd.lv

    I suggest, before investing in systrace fancies, that you consider the following article: http://www.watson.org/~robert/2007woot/ --kk

    Comments

    1. By Matt (82.146.97.67) on

      > I suggest, before investing in systrace fancies, that you consider the following article: http://www.watson.org/~robert/2007woot/ --kk

      I am not quite sure I understand the security implications of using systrace in the described (by Aurel) setup. Wouldn't SCP / SFTP forbid you to actually RUN code on the host? And wouldn't you REQUIRE running code in order to exploit systrace the way your link describes?

      I am very interested in setting this up so I appreciate if someone with more knowledge on systrace could clarify this a bit for me (and probably others)

      Thanks!

      Comments

      1. By swilly (156.143.52.11) on

        > > I suggest, before investing in systrace fancies, that you consider the following article: http://www.watson.org/~robert/2007woot/ --kk
        >
        > I am not quite sure I understand the security implications of using systrace in the described (by Aurel) setup. Wouldn't SCP / SFTP forbid you to actually RUN code on the host? And wouldn't you REQUIRE running code in order to exploit systrace the way your link describes?
        >
        > I am very interested in setting this up so I appreciate if someone with more knowledge on systrace could clarify this a bit for me (and probably others)
        >
        > Thanks!

        from the sftp man page:

        ! command
        Execute command in local shell.

        ! Escape to local shell.

        from my experience, this still works even if Forcecommand is set to sftp-server (it has been a while, so could be wrong)

        Comments

        1. By tedu (204.14.154.18) on

          > > > I suggest, before investing in systrace fancies, that you consider the following article: http://www.watson.org/~robert/2007woot/ --kk
          > >
          > > I am not quite sure I understand the security implications of using systrace in the described (by Aurel) setup. Wouldn't SCP / SFTP forbid you to actually RUN code on the host? And wouldn't you REQUIRE running code in order to exploit systrace the way your link describes?
          > >
          > > I am very interested in setting this up so I appreciate if someone with more knowledge on systrace could clarify this a bit for me (and probably others)
          > >
          > > Thanks!
          >
          > from the sftp man page:
          >
          > ! command
          > Execute command in local shell.
          >
          > ! Escape to local shell.
          >
          > from my experience, this still works even if Forcecommand is set to sftp-server (it has been a while, so could be wrong)

          if only there were a way to use systrace to prevent executing other commands.

        2. By Anonymous Coward (134.58.253.57) on


          > from the sftp man page:
          >
          > ! command
          > Execute command in local shell.
          >
          > ! Escape to local shell.
          >
          > from my experience, this still works even if Forcecommand is set to sftp-server (it has been a while, so could be wrong)

          Yes, a _local_ shell, i.e., on the client machine, not the server.

          Comments

          1. By swilly (156.143.52.238) on

            *starts eating hat*

            Thanks for catching that -

            >
            > > from the sftp man page:
            > >
            > > ! command
            > > Execute command in local shell.
            > >
            > > ! Escape to local shell.
            > >
            > > from my experience, this still works even if Forcecommand is set to sftp-server (it has been a while, so could be wrong)
            >
            > Yes, a _local_ shell, i.e., on the client machine, not the server.
            >

      2. By tedu (204.14.154.18) on

        > > I suggest, before investing in systrace fancies, that you consider the following article: http://www.watson.org/~robert/2007woot/ --kk
        >
        > I am not quite sure I understand the security implications of using systrace in the described (by Aurel) setup. Wouldn't SCP / SFTP forbid you to actually RUN code on the host? And wouldn't you REQUIRE running code in order to exploit systrace the way your link describes?

        exactly. actually understanding how systrace works and how you can circumvent it (or not) is harder than just posting a link ot watson's paper over and over. you can use systrace to prevent users from circumventing systrace.

  10. Comments

    1. By Damien Miller (djm) on http://www.mindrot.org/~djm/

      > http://www.watson.org/~robert/2007woot/ (why the above or any other
      > systrace-based security measures are theoretically ineffective)

      They are only ineffective IF your policy and environment allow threads and/or multiple processes that share memory. Don't allow it and everything is fine.

  11. By Bryan Irvine (71.35.137.152) root@allyourbasearebelongto.us on

    Funny you ask. A friend of mine (hi Pete) and I have already done this with a patch to sftp-server.

    http://www.minstrel.org.uk/papers/sftp/

  12. By sthen (85.158.45.32) on

    Here's what you've been waiting for:- 
    CVSROOT:        /cvs
Module name:    src
Changes by:     djm@cvs.openbsd.org     2008/02/08 16:24:08

Modified files:
        usr.bin/ssh    : sshd_config.5 sshd_config sftp.h sftp-server.c
                         sftp-server-main.c session.c servconf.h
                         servconf.c

Log message:
add sshd_config ChrootDirectory option to chroot(2) users to a directory and
tweak internal sftp server to work with it (no special files in chroot
required). ok markus@
    (note, this is for shells too). nice...

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]