PowerShell / PowerShell/Win32-OpenSSH

OpenSSH CHROOT for Windows 12 - Restrict SFTP to specific folder does not work

Open
#1,687 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

I have portable OpenSSH setup and services for sshd and agent are configured from the OpenSSH folder (C:\OpenSSH-Win64).
Also we have changed the default port and it is working fine.

I have referred the earlier post https://github.com/PowerShell/Win32-OpenSSH/issues/190 about setting CHROOT, but user is redirecting to it's home directory i.e. "/C:/Users/testuser" (username = "testuser") instead of mentioned ChrootDirectory.

Below are configuration of my sshd_config_default file

ForceCommand internal-sftp
Match User testuser
Subsystem  sftp   sftp-server.exe -d "/E:/SHARED_LOCATION/ABC"
ChrootDirectory /E:/SHARED_LOCATION/ABC

PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
AllowUsers testuser 

Please let me know if I am missing anything.

Permissions for E:\SHARED_LOCATION are Read & Execute

Also is it possible to have 2 different users or groups have different ChrootDirectory settings in ssh_config_default ?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reported sshd_config_default settings, especially the Match User, Subsystem, and ChrootDirectory directives, and compare them with the earlier issue #190. Reproduce the redirect using the portable OpenSSH setup and the stated E:\SHARED_LOCATION permissions; done means testuser is restricted to the requested folder and the supported configuration for multiple users or groups is documented.

Written by the indexing model from the issue text.

Assessment

Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.