Hacker News Reader

Comment by effie | Hacker News Reader

Is there a more security-oriented alternative to SSHFS, where the connecting client won't be given shell access on the server? I just want to share a directory from server to an untrusted VM over network, and have VM mount it, not give the VM shell access to the server.

FTP is close to such a thing, but it is somewhat archaic, slow and not sure about its security.

View on HN

If the user account is only supposed to have file transfer capabilities/no shell access, add it a to a specific group e.g. `sftponly`, and only allow this group to use the `internal-sftp` command in `/etc/ssh/sshd_config`

    Match Group sftponly
    ForceCommand internal-sftp -l INFO -f LOCAL6
    AllowTcpForwarding no
    AllowAgentForwarding no
    GatewayPorts no
    X11Forwarding no

Thank you, this seems to prevent client getting shell on the server, while allowing it to make SSHFS mounts. I've put /usr/sbin/nologin into client's row in /etc/passwd on the server as well (/dev/null would break everything including SSHFS).

Is there some way to specify that nothing except internal-sftp is allowed, as opposed to setting each option explicitly to "no"? The latter way seems error-prone, one is bound to miss some obscure option there.

And I wonder why do you suggest using the LOCAL6 log facility? In sftp-server, the default is AUTH...

Reply on news.ycombinator.com