PowerShell / PowerShell/Win32-OpenSSH

Unable to restrict specific folder access for SFTP user in windows

Open
#1,857 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

I have configured SFTP in my Azure VM windows 2019 datacenter. I am able to connect to the server through Winscp in a different port. Now the SFTP user which I have created need to read/write only on a specific folder in C drive. I have tried steps from many blogs regarding restricting the folder access and made changes in the ssh_config file inside "programdata-->ssh-->ssh_config". After making changes in config file, when I try to start the openssh service in services.msc, the service is not starting.

Tried steps
adding the below lines and dint work

Match User sftpuser1
ChrootDirectory C:\SFTP
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding no

Also tried these below steps

Make a Windows group with all your SFTP users in it
Make sure, this group has access to your target directorie(s)
Add subsystem sftp internal-sftp to your sshd_config (or change it)
Restrict the new group to a directory through ChrootDirectory in sshd_config
Like this, for Example:

Match Group sftpusers
ChrootDirectory C:\SFTP
AllowTCPForwarding no
X11Forwarding no
ForceCommand internal-sftp

Nothing works!!
Please do help on this

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the OpenSSH configuration under ProgramData\ssh and the service behavior in services.msc, comparing the shown Match, ChrootDirectory, and ForceCommand settings. Confirm which configuration change prevents the service from starting, then verify that the service runs and the SFTP user is limited to C:\SFTP.

Written by the indexing model from the issue text.

Assessment

Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.