Skip to content

Commit 93b2a86

Browse files
serghey-rodinserghey-rodin
committed
Jailed SFTP via OpenSSH
1 parent f451b8a commit 93b2a86

File tree

8 files changed

+344
-0
lines changed

8 files changed

+344
-0
lines changed

‎bin/v-add-sys-sftp-jail‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
#!/bin/bash
2+
# info: add system sftp jail
3+
# opions: NONE
4+
#
5+
# The script enables sftp jailed environment
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Importing system enviroment as we run this script
13+
# mostly by cron wich do not read it by itself
14+
source /etc/profile
15+
16+
# Includes
17+
source $VESTA/func/main.sh
18+
source $VESTA/conf/vesta.conf
19+
20+
21+
#----------------------------------------------------------#
22+
# Verifications #
23+
#----------------------------------------------------------#
24+
25+
if [ -z "$SFTPJAIL_KEY" ]; then
26+
exit
27+
fi
28+
29+
30+
#----------------------------------------------------------#
31+
# Action #
32+
#----------------------------------------------------------#
33+
34+
# Checking sshd directives
35+
config='/etc/ssh/sshd_config'
36+
sftp_n=$(grep -n "Subsystem.*sftp" $config |grep -v internal |grep -v ":#")
37+
sftp_i=$(grep -n "Subsystem.*sftp" $config |grep internal |grep -v ":#")
38+
39+
# Disabling normal sftp
40+
if [ ! -z "$sftp_n" ]; then
41+
fline=$(echo $sftp_n |cut -f 1 -d :)
42+
sed -i "${fline}s/Subsystem.*sftp/#Subsystem sftp/" $config
43+
restart='yes'
44+
fi
45+
46+
# Enabling jailed sftp
47+
if [ -z "$sftp_i" ]; then
48+
echo "Subsystem sftp internal-sftp" >> $config
49+
echo "Match Group sftp-only" >> $config
50+
echo "ChrootDirectory /chroot/%u" >> $config
51+
echo " AllowTCPForwarding no" >> $config
52+
echo " X11Forwarding no" >> $config
53+
echo " ForceCommand internal-sftp" >> $config
54+
restart='yes'
55+
fi
56+
57+
# Validating opensshd config
58+
if [ "$restart" = 'yes' ]; then
59+
subj="OpenSSH restart failed"
60+
email=$(grep CONTACT $VESTA/data/users/admin/user.conf |cut -f 2 -d \')
61+
send_mail="$VESTA/web/inc/mail-wrapper.php"
62+
/usr/sbin/sshd -t >/dev/null 2>&1
63+
if [ "$?" -ne 0 ]; then
64+
mail_text="OpenSSH can not be restarted. Please check config:
65+
\n\n$(/usr/sbin/sshd -t)"
66+
echo -e "$mail_text" | $send_mail -s "$subj" $email
67+
else
68+
service ssh restart >/dev/null 2>&1
69+
service sshd restart >/dev/null 2>&1
70+
fi
71+
fi
72+
73+
# Adding sftp group
74+
groupadd sftp-only 2>/dev/null
75+
76+
# Checking users
77+
shells="rssh|nologin"
78+
for user in $(grep "$HOMEDIR" /etc/passwd |egrep "$shells" |cut -f 1 -d:); do
79+
$BIN/v-add-user-sftp-jail $user
80+
done
81+
82+
# Adding v-add-sys-sftp-jail to startup
83+
if [ -e "/etc/rc.local" ]; then
84+
check_sftp=$(grep $0 /etc/rc.local)
85+
check_exit=$(grep ^exit /etc/rc.local)
86+
if [ -z "$check_sftp" ]; then
87+
if [ -z "$check_exit" ]; then
88+
echo "$BIN/v-add-sys-sftp-jail" >> /etc/rc.local
89+
else
90+
sed -i "s|^exit|$BIN/v-add-sys-sftp-jail\nexit|" /etc/rc.local
91+
fi
92+
fi
93+
chmod +x /etc/rc.local
94+
else
95+
echo "$BIN/v-add-sys-sftp-jail" > /etc/rc.local
96+
chmod +x /etc/rc.local
97+
fi
98+
99+
#----------------------------------------------------------#
100+
# Vesta #
101+
#----------------------------------------------------------#
102+
103+
# Logging
104+
log_event "$OK" "$EVENT"
105+
106+
exit

‎bin/v-add-user‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,11 @@ if [ -x "$VESTA/data/packages/$package.sh" ]; then
207207
$VESTA/data/packages/$package.sh "$user" "$email" "$fname" "$lname"
208208
fi
209209

210+
# Adding jailed sftp env
211+
if [ ! -z "$SFTPJAIL_KEY" ]; then
212+
$BIN/v-add-user-sftp-jail $user
213+
fi
214+
210215
# Logging
211216
log_history "added system user $user" '' 'admin'
212217
log_event "$OK" "$EVENT"

‎bin/v-add-user-sftp-jail‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#!/bin/bash
2+
# info: add user sftp jail
3+
# opions: USER
4+
#
5+
# The script enables sftp jailed environment
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument defenition
13+
user=$1
14+
15+
# Includes
16+
source $VESTA/func/main.sh
17+
source $VESTA/conf/vesta.conf
18+
19+
20+
#----------------------------------------------------------#
21+
# Verifications #
22+
#----------------------------------------------------------#
23+
24+
check_args '1' "$#" 'USER'
25+
validate_format 'user'
26+
if [ -z "$SFTPJAIL_KEY" ]; then
27+
exit
28+
fi
29+
user_str=$(grep "^$user:" /etc/passwd |egrep "rssh|nologin")
30+
if [ -z "$user_str" ]; then
31+
exit
32+
fi
33+
34+
#----------------------------------------------------------#
35+
# Action #
36+
#----------------------------------------------------------#
37+
38+
# Defining user homedir
39+
home="$(echo $user_str |cut -f 6 -d :)"
40+
41+
# Adding chroot directory
42+
if [ ! -d "/chroot/$user/$home" ]; then
43+
mkdir -p /chroot/$user/$home
44+
chmod 750 /chroot/$user
45+
chmod 775 /chroot/$user/$home
46+
chown root:sftp-only /chroot/$user
47+
chown $user:sftp-only /chroot/$user/$home
48+
fi
49+
50+
# Adding user to sftp group
51+
usermod -a -G sftp-only $user
52+
53+
# Mouting home directory
54+
if [ -z "$(mount |grep $home)" ]; then
55+
mount -o bind $home /chroot/$user/$home/
56+
fi
57+
58+
59+
#----------------------------------------------------------#
60+
# Vesta #
61+
#----------------------------------------------------------#
62+
63+
# Logging
64+
#log_event "$OK" "$EVENT"
65+
66+
exit

‎bin/v-add-web-domain-ftp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,11 @@ fi
9494
echo "$ftp_user:$password" | /usr/sbin/chpasswd
9595
ftp_md5=$(awk -v user=$ftp_user -F : 'user == $1 {print $2}' /etc/shadow)
9696

97+
# Adding jailed sftp env
98+
if [ ! -z "$SFTPJAIL_KEY" ]; then
99+
$BIN/v-add-user-sftp-jail $ftp_user
100+
fi
101+
97102

98103
#----------------------------------------------------------#
99104
# Vesta #

‎bin/v-change-user-shell‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,11 @@ shell_path=$(grep -w "$shell" /etc/shells | head -n1)
3939
/usr/bin/chsh -s "$shell_path" "$user" &>/dev/null
4040
shell=$(basename $shell_path)
4141

42+
# Adding jailed sftp env
43+
if [ ! -z "$SFTPJAIL_KEY" ]; then
44+
$BIN/v-add-user-sftp-jail $user
45+
fi
46+
4247

4348
#----------------------------------------------------------#
4449
# Vesta #

‎bin/v-delete-sys-sftp-jail‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#!/bin/bash
2+
# info: delete system sftp jail
3+
# opions: NONE
4+
#
5+
# The script enables sftp jailed environment
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Importing system enviroment as we run this script
13+
# mostly by cron wich do not read it by itself
14+
source /etc/profile
15+
16+
# Includes
17+
source $VESTA/func/main.sh
18+
source $VESTA/conf/vesta.conf
19+
20+
21+
#----------------------------------------------------------#
22+
# Verifications #
23+
#----------------------------------------------------------#
24+
25+
if [ -z "$SFTPJAIL_KEY" ]; then
26+
exit
27+
fi
28+
29+
30+
#----------------------------------------------------------#
31+
# Action #
32+
#----------------------------------------------------------#
33+
34+
# Checking users
35+
for user in $(grep "$HOMEDIR" /etc/passwd |cut -f 1 -d:); do
36+
$BIN/v-delete-user-sftp-jail $user
37+
done
38+
39+
# Checking sshd directives
40+
config='/etc/ssh/sshd_config'
41+
sftp_n=$(grep -n "Subsystem.*sftp" $config |grep -v internal |grep ":#")
42+
sftp_i=$(grep -n "Subsystem.*sftp" $config |grep internal |grep -v ":#")
43+
44+
# Backing up config
45+
cp $config $config.bak-$(date +%s)
46+
47+
# Enabling normal sftp
48+
if [ ! -z "$sftp_n" ]; then
49+
fline=$(echo $sftp_n |cut -f 1 -d :)
50+
sed -i "${fline}s/#Subsystem/Subsystem sftp/" $config
51+
restart='yes'
52+
fi
53+
54+
# Disabling jailed sftp
55+
if [ ! -z "$sftp_i" ]; then
56+
fline=$(echo $sftp_i |cut -f 1 -d :)
57+
lline=$((fline + 5))
58+
sed -i "${fline},${lline}d" $config
59+
restart='yes'
60+
fi
61+
62+
# Validating opensshd config
63+
if [ "$restart" = 'yes' ]; then
64+
subj="OpenSSH restart failed"
65+
email=$(grep CONTACT $VESTA/data/users/admin/user.conf |cut -f 2 -d \')
66+
send_mail="$VESTA/web/inc/mail-wrapper.php"
67+
/usr/sbin/sshd -t >/dev/null 2>&1
68+
if [ "$?" -ne 0 ]; then
69+
mail_text="OpenSSH can not be restarted. Please check config:
70+
\n\n$(/usr/sbin/sshd -t)"
71+
echo -e "$mail_text" | $send_mail -s "$subj" $email
72+
else
73+
service ssh restart >/dev/null 2>&1
74+
service sshd restart >/dev/null 2>&1
75+
fi
76+
fi
77+
78+
# Deleting v-add-sys-sftp-jail from startup
79+
sed -i "/v-add-sys-sftp-jail/d" /etc/rc.local 2>/dev/null
80+
81+
82+
#----------------------------------------------------------#
83+
# Vesta #
84+
#----------------------------------------------------------#
85+
86+
# Logging
87+
log_event "$OK" "$EVENT"
88+
89+
exit

‎bin/v-delete-user-sftp-jail‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/bin/bash
2+
# info: delete user sftp jail
3+
# opions: USER
4+
#
5+
# The script enables sftp jailed environment
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument defenition
13+
user=$1
14+
15+
# Includes
16+
source $VESTA/func/main.sh
17+
source $VESTA/conf/vesta.conf
18+
19+
20+
#----------------------------------------------------------#
21+
# Verifications #
22+
#----------------------------------------------------------#
23+
24+
check_args '1' "$#" 'USER'
25+
validate_format 'user'
26+
user_str=$(grep "^$user:" /etc/passwd)
27+
if [ -z "$user_str" ]; then
28+
exit
29+
fi
30+
31+
#----------------------------------------------------------#
32+
# Action #
33+
#----------------------------------------------------------#
34+
35+
# Defining user homedir
36+
home="$(echo $user_str |cut -f 6 -d :)"
37+
38+
# Unmounting home directory
39+
mount_dir=$(mount |grep /chroot/$user/ |awk '{print $3}')
40+
if [ ! -z "$mount_dir" ]; then
41+
umount -f $mount_dir 2>/dev/null
42+
if [ $? -ne 0 ]; then
43+
gpasswd -d $user sftp-only >/dev/null 2>&1
44+
exit 1
45+
fi
46+
fi
47+
48+
# Deleting chroot dir
49+
rmdir $mount_dir 2>/dev/null
50+
rm -rf /chroot/$user
51+
52+
# Deleting user from sftp group
53+
gpasswd -d $user sftp-only >/dev/null 2>&1
54+
55+
56+
#----------------------------------------------------------#
57+
# Vesta #
58+
#----------------------------------------------------------#
59+
60+
# Logging
61+
#log_event "$OK" "$EVENT"
62+
63+
exit

‎bin/v-delete-web-domain-ftp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ if [ "$?" != 0 ]; then
5151
sed -i "/^$ftp_user:/d" /etc/shadow
5252
fi
5353

54+
# Deleting sftp jail
55+
if [ ! -z "$SFTPJAIL_KEY" ]; then
56+
$BINv-delete-user-sftp-jail $ftp_user
57+
fi
58+
5459

5560
#----------------------------------------------------------#
5661
# Vesta #

0 commit comments

Comments
 (0)