Problems with FTP on Panther

Quoted from Adam's article on Apple's 9-7-04 security update in this weeks TidBITS (9/13/04):

"perhaps the best (solution to the new broken FTP issue) is to use this problem as an excuse to switch to SFTP, which eliminates long-standing security problems with FTP."

<http://db.tidbits.com/getbits.acgi?tbart=07809>

For anyone considering taking this advice and switching to SFTP, it should be noted (as someone metioned in the Apple discussion linked to in the article), that while SFTP does eliminate some security issues, it introduces other, possibly bigger ones.

In OS X server, there is no "out of the box" chroot functionality when using FTP over SSH (aka SFTP). This results in ftp (or ssh) users being able to "cd" up out of their home directory, and having a nice view of the entire filesystem, as permissions allow. For some systems this would not be a huge problem, but for many it would, especially in a multi-user hosting environment.

Fixing this by hand-crafting a proper chroot environment would be about as fun as it looks here:

http://chrootssh.sourceforge.net/docs/chrootedsftp.html

At 8:39 AM -0700 9/14/04, Dave Walcott wrote:
Quoted from Adam's article on Apple's 9-7-04 security update in this
> weeks TidBITS (9/13/04):
>
> "perhaps the best (solution to the new broken FTP issue) is to use
> this problem as an excuse to switch to SFTP, which eliminates
> long-standing security problems with FTP."
>
> <http://db.tidbits.com/getbits.acgi?tbart=07809>
>
> For anyone considering taking this advice and switching to SFTP, it
> should be noted (as someone metioned in the Apple discussion linked
> to in the article), that while SFTP does eliminate some security
> issues, it introduces other, possibly bigger ones.
>
> In OS X server, there is no "out of the box" chroot functionality
> when using FTP over SSH (aka SFTP). This results in ftp (or ssh)
> users being able to "cd" up out of their home directory, and having a
> nice view of the entire filesystem, as permissions allow. For some
> systems this would not be a huge problem, but for many it would,
> especially in a multi-user hosting environment.

Yes, but so far as I know there's no anonymous sftp. So the only
people that have access to the machine via sftp already have access
via ssh to a shell. So they can see the entire file system anyway.

--
Paul Schinder
schinderpobox.com

-----Original Message-----
From: Dave Walcott [mailto:davewalcott.com]
Sent: Tuesday, September 14, 2004 11:39 AM
To: tidbits-talktidbits.com
Subject: Re: Problems with FTP on Panther

For anyone considering taking this advice and switching to SFTP, it should be noted (as someone metioned in the Apple discussion linked to in the article), that while SFTP does eliminate some security issues, it introduces other, possibly bigger ones.

In OS X server, there is no "out of the box" chroot functionality when using FTP over SSH (aka SFTP). This results in ftp (or ssh) users being able to "cd" up out of their home directory, and having a nice view of the entire filesystem, as permissions allow. For some systems this would not be a huge probl! em, but for many it would, especially in a multi-user hosting environment. 

Yes, but so far as I know there's no anonymous sftp. So the only people that have access to the machine via sftp already have access via ssh to a shell. So they can see the entire file system anyway.

Yep - that was exactly my point - with regular FTP, there isn't a chroot problem. But - when you tick the "Remote Login" box to enable SFTP and ssh access, that opens up the security issue I mentioned. Users can then peruse the whole filesystem, even seeing some contents of other users home directories (if default permissions are not changed).

Notwithstanding access to other users' home folders, this might not be a big problem on some systems. But in a "best practice" scenario, no sys admin I know wants users poking around the /etc or /var directories and other such areas they don't belong. Even if they can't delete or damage things in those areas, they could copy MySQL, NetInfo and other databases, or grab MySQL passwords from sloppily programmed php files, just for example.

Whether anonymous or not, it's real easy to enable such access without realizing it, which is why I mentioned it. I'm just hoping Apple builds in a nice "Lock SFTP users into home directories" button in a near-future version.

[Apologies to the already dead horse]

Browsing the file system isn't that big a risk, at least not out of the box. Users can't read each other's home directories...

Actually, default permissions for user home directories are 755, so any user actually *can* open anyone else's home directory and look around, out of the box. And, depending on server umask settings (and on whether the user knows to check permissions of all files s/he copies to "home"), that user's files may be read/writable as well.

 The command-line way to set this would be "chmod g-r filename" or "chmod 604 filename" but graphical file transfer programs have ways of setting the file permissions.

This is also not quite correct. Starting with 755 (default) permissions, your first suggestion of "chmod g-r filename" would yield 714, which still allows execution (or opening of folders) by other users. Folks taking your advice would want to use the second, more explicit "chmod 604 filename" (or better yet, "chomd -R 604 /Users/<username>") instead to properly prevent "staff" group members from seeing anything at all.

Which all leads me back to my initial point - if you enable SFTP, make sure you really know what you're enabling! Until Apple fixes this, I'd personally opt for un-encrypted FTP logins and chroot'ed users over encrypted FTP logins and users poking around the filesystem.

The company VanDyke (http://www.vandyke.com/) makes a commercial SFTP server called VShell that offers chroot limitations as well as other access controls. I have not used VShell on Mac OS X but have used it for Windows and it is a good product.

At 12:20 PM -0700 9/23/04, sommersb wrote:
>The company VanDyke (http://www.vandyke.com/) makes a commercial
>SFTP server called VShell that offers chroot limitations as well as
>other access controls. I have not used VShell on Mac OS X but have
>used it for Windows and it is a good product.

We've used and bulk-licensed several VanDyke products for years, for
our Windows clients. CRT, SecureCRT, AbsoluteFTP and probably a few
others. Good suff.

I didn't know that they'd expanded into non-Windows platforms. Interesting.

--
Andrew Laurence
atlaurenuci.edu