Bug 2048 (PreLoginCommand)

I'll be bit verbose, sorry.

There are lots of people running own shared hosting machines and they are in need to suply some kind of remote acess to their clients. Most of them are using FTP/FTPS, but i think that SFTP/SCP is much better, more secure and less problematic. We all know that we can't make normal Windows BFU see all system files and let him to search own home directory in directory structure because this will often leave him confused and he'll often call helpdesk and complain about it. That's one of reasons why we have chroot support in OpenSSH. Other reason is obvious: better security.

So this is typical configuration:

Subsystem       sftp    internal-sftp

Match Group sftpusers
   ChrootDirectory %h
   ForceCommand internal-sftp
   AllowTcpForwarding no


It has one big problem. For security reasons we cannot chroot into directory that is not owned by root (or writable by user). There's probably nothing we can do about this right now, but let's take a deeper look and see if there are some workarounds which will prevent us from modifying directory structure, chowning all homes to root (such home is no longer "sweet home"), etc...

And guess what. I've came up with solution that enables OpenSSH to securely isolate user without disabling writing to home directory!

I've implemented it as PoC pam_module (not very secure at this moment), but i hope it can make it's way directly into OpenSSH. I'll tell you more, but here is the source if you wish anyway:
https://github.com/Harvie/pam-ftpfuck/blob/master/src/mypam.c


So how it works?
It bind-mounts home directory of user into subdirectory of root-owned directory created especially for this user...

so we're no longer chrooting into /home/user/ (which can be now owned by root)
we'll rather chroot into /var/ssh-chroot/user/ (which is created on demand and owned by root)
and it contains user owned directory /var/ssh-chroot/user/user/ which is bind mount pointig to /home/user/

So after loging into SFTP server our client will only see root containing single directory /user which seems to me quite user friendly :-)

Of course we can create these bind-mounts by some cron-script, but it's not nearly as elegant as when done directly on-demand by OpenSSH.


Other thoughts?
- Read-only bind mounts! (don't forget to check if RO option successfully aplied)
- I am not sure if bind mounts are available on BSDs (never been using BSD), maybe mount_null or some kind of symlinks can be used???