0

We have the need to create a user that can only stay in his/her directory... no very dificult... we assined the user the /bin/rbash shell. Any try to move to another directory but his home, pointless. Good! so far so good. Then we received the requirement to mount that directory as a network drive in windows... we found a software called SFTP Net Drive (mount via SSH) this software does its job flawlessly but when the user has assigned the /bin/rbash login shell(/etc/passwd), no connection is possible ... "connection failes due to error 103" Normal SSh Via putty works perfectly. I even tried SCP Windows Graphical tool (Secure Copy) and again no connection is possible either. The failing protocols in both cases are SFTP. Any idea?

14
  • 1
    Sounds like a problem with that software. and since it's a Windows software piece I think you might be stuck needing to contact their support for it
    – Thomas Ward
    Jul 12, 2018 at 13:43
  • both Softwares WinSCP and SFTP Net Drive have the the same issue. Both works perfect with user having /bin/bash shell but both don't work with users having /etc/rbash as a shell, to be honest I thing is my problem not the software.
    – Luis Angel
    Jul 12, 2018 at 13:50
  • 1
    Is there a reason you're having them use rbash instead of the usual /bin/bash other than for the directory isolation? I would probably have gone the route of setting up a chroot'd folder for the user to be able to connect to, rather than forcing a user to stay in their own directory with a different shell than WinSCP and other software are used to dealing with.
    – Thomas Ward
    Jul 12, 2018 at 13:56
  • rbash satisfies all the restrictions that we want to impose on the user who connects.
    – Luis Angel
    Jul 12, 2018 at 14:04
  • 1
    I suspect it's a restriction of the OpenSSH sftp-internal implementation: I can confirm that WinSCP fails with message Cannot initialize SFTP protocol. Is the host running a SFTP server? when the user's login shell is /bin/rbash HOWEVER changing the protocol to SCP in the WinSCP connection dialog works fine (and appears to respect the directory traversal restrictions of the rbash shell) Jul 12, 2018 at 14:24

1 Answer 1

4

When we search for "rbash sftp doesn't work", we get a large list of messages to various forum boards that rbash and SFTP don't work. I found a Server Fault page that might help though, so I'll borrow that content from that post over on Server Fault by Server Fault user mr.spuratic. It might help explain a few things about why standard SFTP fails:

rbash won't let you run commands with a leading /, if that's being attempted then it will simply exit.

Unless you're using the internal sftp-server, an attempt to exec /usr/libexec/sftp-server will fail.

Using Subsystem sftp internal-sftp in the sshd_config will fix that.

However, using rbash won't stop sftp from wandering around your filesystem, you probably want to chroot the users instead.

So in effect, I believe whatever's happening underneath the hood is trying to get a directory listing of a path beginning with /. That will fail in rbash.

This said, you need to be aware that as I stated in comments and this answer I borrowed from Server Fault, rbash works best when you also implement chrooted user directories, because SFTP will bypass the restrictions that rbash puts into play and can still technically wander around your filesystem.

You really need to implement, in addition to rbash, chrooted user directories. This will also protect the SFTP component from drifting around the system.

1
  • This answer is the point and makes sense I'm gonna try something else. Thank all of you guys.
    – Luis Angel
    Jul 12, 2018 at 15:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .