PowerShell / PowerShell/Win32-OpenSSH
Unable to restrict specific folder access for SFTP user in windows
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
I have configured SFTP in my Azure VM windows 2019 datacenter. I am able to connect to the server through Winscp in a different port. Now the SFTP user which I have created need to read/write only on a specific folder in C drive. I have tried steps from many blogs regarding restricting the folder access and made changes in the ssh_config file inside "programdata-->ssh-->ssh_config". After making changes in config file, when I try to start the openssh service in services.msc, the service is not starting.
Tried steps
adding the below lines and dint work
Match User sftpuser1
ChrootDirectory C:\SFTP
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding no
Also tried these below steps
Make a Windows group with all your SFTP users in it
Make sure, this group has access to your target directorie(s)
Add subsystem sftp internal-sftp to your sshd_config (or change it)
Restrict the new group to a directory through ChrootDirectory in sshd_config
Like this, for Example:
Match Group sftpusers
ChrootDirectory C:\SFTP
AllowTCPForwarding no
X11Forwarding no
ForceCommand internal-sftp
Nothing works!!
Please do help on this
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the OpenSSH configuration under ProgramData\ssh and the service behavior in services.msc, comparing the shown Match, ChrootDirectory, and ForceCommand settings. Confirm which configuration change prevents the service from starting, then verify that the service runs and the SFTP user is limited to C:\SFTP.
Written by the indexing model from the issue text.
Assessment
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100