Skip to content

Commit 9743e6d

Browse files
ScIT-RaphaelScIT-Raphael
committed
Rewrite sftp jail with mount free version, thanks to @dpeca!
1 parent a3d2ae4 commit 9743e6d

4 files changed

Lines changed: 50 additions & 69 deletions

File tree

‎bin/v-add-sys-sftp-jail‎

Lines changed: 5 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ source $HESTIA/conf/hestia.conf
2727
# Checking sshd directives
2828
config='/etc/ssh/sshd_config'
2929
sftp_n=$(grep -n "Subsystem.*sftp" $config |grep -v internal |grep -v ":#")
30-
sftp_i=$(grep -n "Subsystem.*sftp" $config |grep internal |grep -v ":#")
30+
sftp_i=$(grep -n "^# Hestia SFTP Chroot" $config)
3131

3232
# Disabling normal sftp
3333
if [ ! -z "$sftp_n" ]; then
@@ -39,11 +39,11 @@ fi
3939
# Enabling jailed sftp
4040
if [ -z "$sftp_i" ]; then
4141
echo " " >> $config
42-
echo "Subsystem sftp internal-sftp" >> $config
43-
echo "Match Group sftp-only" >> $config
44-
echo "ChrootDirectory /chroot/%u" >> $config
45-
echo " AllowTCPForwarding no" >> $config
42+
echo "# Hestia SFTP Chroot" >> $config
43+
echo "Match User sftp_dummy99" >> $config
44+
echo "ChrootDirectory %h" >> $config
4645
echo " X11Forwarding no" >> $config
46+
echo " AllowTCPForwarding no" >> $config
4747
echo " ForceCommand internal-sftp" >> $config
4848
restart='yes'
4949
fi
@@ -63,32 +63,12 @@ if [ "$restart" = 'yes' ]; then
6363
fi
6464
fi
6565

66-
# Adding sftp group
67-
groupadd sftp-only 2>/dev/null
68-
6966
# Checking users
7067
shells="rssh|nologin"
7168
for user in $(grep "$HOMEDIR" /etc/passwd |egrep "$shells" |cut -f 1 -d:); do
7269
$BIN/v-add-user-sftp-jail $user
7370
done
7471

75-
# Adding v-add-sys-sftp-jail to startup
76-
if [ -e "/etc/rc.local" ]; then
77-
check_sftp=$(grep $0 /etc/rc.local)
78-
check_exit=$(grep ^exit /etc/rc.local)
79-
if [ -z "$check_sftp" ]; then
80-
if [ -z "$check_exit" ]; then
81-
echo "$BIN/v-add-sys-sftp-jail" >> /etc/rc.local
82-
else
83-
sed -i "s|^exit|$BIN/v-add-sys-sftp-jail\nexit|" /etc/rc.local
84-
fi
85-
fi
86-
chmod +x /etc/rc.local
87-
else
88-
echo "$BIN/v-add-sys-sftp-jail" > /etc/rc.local
89-
chmod +x /etc/rc.local
90-
fi
91-
9272
#----------------------------------------------------------#
9373
# Hestia #
9474
#----------------------------------------------------------#

‎bin/v-add-user-sftp-jail‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -33,36 +33,36 @@ if [ $user = "syslog" ]; then
3333
exit
3434
fi
3535

36+
# Get current users and split into array
37+
ssh_users=$(grep -A1 "^# Hestia SFTP Chroot" /etc/ssh/sshd_config | sed -n 2p | sed 's/Match User //')
38+
IFS=',' read -r -a users <<< "$ssh_users"
39+
40+
# Check if jail is already enabled
41+
if [[ ! " ${users[@]} " =~ " ${user} " ]]; then
42+
exit
43+
fi
44+
3645

3746
#----------------------------------------------------------#
3847
# Action #
3948
#----------------------------------------------------------#
4049

41-
# Defining user homedir
42-
home="$(echo $user_str |cut -f 6 -d :)"
50+
# Add user to array
51+
users+=($user)
4352

44-
# Adding chroot directory
45-
if [ ! -d "/chroot/$user/$home" ]; then
46-
mkdir -p /chroot/$user/$home
47-
chmod 750 /chroot/$user
48-
chmod 775 /chroot/$user/$home
49-
chown root:sftp-only /chroot/$user
50-
chown $user:sftp-only /chroot/$user/$home
51-
fi
52-
53-
# Adding user to sftp group
54-
usermod -a -G sftp-only $user
55-
56-
# Mouting home directory
57-
if [ -z "$(mount |grep /chroot/$user/$home)" ]; then
58-
mount -o bind $home /chroot/$user/$home/
59-
fi
53+
# Write new user list to config
54+
users=$(IFS=',';echo "${users[*]// /|}";IFS=$' \t\n')
55+
sed -i "s/$ssh_users/$users/g" /etc/ssh/sshd_config
6056

6157

6258
#----------------------------------------------------------#
6359
# Hestia #
6460
#----------------------------------------------------------#
6561

62+
# Restart ssh service
63+
service ssh restart > /dev/null 2>&1
64+
service sshd restart > /dev/null 2>&1
65+
6666
# Logging
6767
log_event "$OK" "$ARGUMENTS"
6868

‎bin/v-delete-sys-sftp-jail‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27,15 +27,10 @@ source $HESTIA/conf/hestia.conf
2727
# Action #
2828
#----------------------------------------------------------#
2929

30-
# Checking users
31-
for user in $(grep "$HOMEDIR" /etc/passwd |cut -f 1 -d:); do
32-
$BIN/v-delete-user-sftp-jail $user
33-
done
34-
3530
# Checking sshd directives
3631
config='/etc/ssh/sshd_config'
3732
sftp_n=$(grep -n "Subsystem.*sftp" $config |grep -v internal |grep ":#")
38-
sftp_i=$(grep -n "Subsystem.*sftp" $config |grep internal |grep -v ":#")
33+
sftp_i=$(grep -n "^# Hestia SFTP Chroot" $config)
3934

4035
# Backing up config
4136
cp $config $config.bak-$(date +%s)
@@ -70,14 +65,15 @@ if [ "$restart" = 'yes' ]; then
7065
fi
7166
fi
7267

73-
# Deleting v-add-sys-sftp-jail from startup
74-
sed -i "/v-add-sys-sftp-jail/d" /etc/rc.local 2>/dev/null
75-
7668

7769
#----------------------------------------------------------#
7870
# Hestia #
7971
#----------------------------------------------------------#
8072

73+
# Restart ssh service
74+
service ssh restart > /dev/null 2>&1
75+
service sshd restart > /dev/null 2>&1
76+
8177
# Logging
8278
log_event "$OK" "$ARGUMENTS"
8379

‎bin/v-delete-user-sftp-jail‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -28,35 +28,40 @@ if [ -z "$user_str" ]; then
2828
exit
2929
fi
3030

31+
# Get current users and split into array
32+
ssh_users=$(grep -A1 "^# Hestia SFTP Chroot" /etc/ssh/sshd_config | sed -n 2p | sed 's/Match User //')
33+
IFS=',' read -r -a users <<< "$ssh_users"
34+
35+
# Check if jail exist
36+
if [[ ! " ${users[@]} " =~ " ${user} " ]]; then
37+
exit
38+
fi
39+
40+
3141
#----------------------------------------------------------#
3242
# Action #
3343
#----------------------------------------------------------#
3444

35-
# Defining user homedir
36-
home="$(echo $user_str |cut -f 6 -d :)"
37-
38-
# Unmounting home directory
39-
mount_dir=$(mount |grep /chroot/$user/ |awk '{print $3}')
40-
if [ ! -z "$mount_dir" ]; then
41-
umount -f $mount_dir 2>/dev/null
42-
if [ $? -ne 0 ]; then
43-
gpasswd -d $user sftp-only >/dev/null 2>&1
44-
exit 1
45+
# Remove user from array
46+
for sftp_user in "${users[@]}"; do
47+
if [ "$sftp_user" != "$user" ]; then
48+
new_users+=($sftp_user)
4549
fi
46-
fi
50+
done
4751

48-
# Deleting chroot dir
49-
rmdir $mount_dir 2>/dev/null
50-
rm -rf /chroot/$user
51-
52-
# Deleting user from sftp group
53-
gpasswd -d $user sftp-only >/dev/null 2>&1
52+
# Write new user list to config
53+
users=$(IFS=',';echo "${new_users[*]// /|}";IFS=$' \t\n')
54+
sed -i "s/$ssh_users/$users/g" /etc/ssh/sshd_config
5455

5556

5657
#----------------------------------------------------------#
5758
# Hestia #
5859
#----------------------------------------------------------#
5960

61+
# Restart ssh service
62+
service ssh restart > /dev/null 2>&1
63+
service sshd restart > /dev/null 2>&1
64+
6065
# Logging
6166
#log_event "$OK" "$ARGUMENTS"
6267

0 commit comments

Comments
 (0)