We have the need to create a user that can only stay in his/her directory... no very dificult... we assined the user the /bin/rbash shell. Any try to move to another directory but his home, pointless. Good! so far so good. Then we received the requirement to mount that directory as a network drive in windows... we found a software called SFTP Net Drive (mount via SSH) this software does its job flawlessly but when the user has assigned the /bin/rbash login shell(/etc/passwd), no connection is possible ... "connection failes due to error 103" Normal SSh Via putty works perfectly. I even tried SCP Windows Graphical tool (Secure Copy) and again no connection is possible either. The failing protocols in both cases are SFTP. Any idea?
1 Answer
When we search for "rbash sftp doesn't work", we get a large list of messages to various forum boards that rbash and SFTP don't work. I found a Server Fault page that might help though, so I'll borrow that content from that post over on Server Fault by Server Fault user mr.spuratic. It might help explain a few things about why standard SFTP fails:
rbash
won't let you run commands with a leading/
, if that's being attempted then it will simply exit.Unless you're using the internal sftp-server, an attempt to exec
/usr/libexec/sftp-server
will fail.Using
Subsystem sftp internal-sftp
in thesshd_config
will fix that.However, using
rbash
won't stop sftp from wandering around your filesystem, you probably want to chroot the users instead.
So in effect, I believe whatever's happening underneath the hood is trying to get a directory listing of a path beginning with /
. That will fail in rbash
.
This said, you need to be aware that as I stated in comments and this answer I borrowed from Server Fault, rbash
works best when you also implement chrooted user directories, because SFTP will bypass the restrictions that rbash
puts into play and can still technically wander around your filesystem.
You really need to implement, in addition to rbash
, chrooted user directories. This will also protect the SFTP component from drifting around the system.
-
This answer is the point and makes sense I'm gonna try something else. Thank all of you guys. Jul 12, 2018 at 15:19
/bin/bash
other than for the directory isolation? I would probably have gone the route of setting up a chroot'd folder for the user to be able to connect to, rather than forcing a user to stay in their own directory with a different shell than WinSCP and other software are used to dealing with.sftp-internal
implementation: I can confirm that WinSCP fails with messageCannot initialize SFTP protocol. Is the host running a SFTP server?
when the user's login shell is/bin/rbash
HOWEVER changing the protocol toSCP
in the WinSCP connection dialog works fine (and appears to respect the directory traversal restrictions of therbash
shell)