sftp sandboxing
a day ago
- SFTP can be used to share large files (e.g., 300 MB) peer-to-peer over a public network without hosting costs.
- Default SFTP through SSH exposes too much system access, including read access to most files and write access to user-owned files.
- A read-only SFTP server can be set up by editing /etc/ssh/sshd_config to use internal-sftp with the -R flag, ChrootDirectory, and ForceCommand.
- ChrootDirectory restricts the user to their home directory and requires root ownership of the path to prevent chroot escape security risks.
- Commands like mkdir, chmod, and other write operations are denied in this read-only SFTP configuration.
- DisableForwarding and setting no login password (via useradd) further secure the server by preventing misuse as a jumpbox or via password guessing.
- The configuration should apply the -R flag under the specific user Match block to avoid disabling write access for all users.