Ssh – Using ACLs over read only/remote filesystem

aclfusesshfs

I would like to define local ACLs to be used over a remotely mounted filesystem.
The filesystem is mounted via autofs and sshfs FUSE.

The idea is that we could set up a jailed user on a jump server with access to read files on other servers in the environment and use standard commands without a lot of exposure and certainly without granting ssh access.
Problem is, sshfs will always run as the same user, so files within the path on the remote system would be exposed regardless of the user that they were exposed for.

I've explored coding the security check right into sshfs, but before I go down that road I'd like to see if any other package can add ACL support to an otherwise read only filesystem.

Edit: @peterph How would you set your ACLs for the NFS share when the remote filesystem is read only?

sshfs was really easy to take apart, so I added the ACL check right into sshfs itself a few days after writing this. Users get jailed on login via OpenSSH and jailkit, and access the read only sshfs automount as a non-privileged user from there. Every dir/file stat or read generates a syslog event. It's been working like a charm and the users have no rights off of the one jailed box.

Best Answer

Is there a reason for not using NFS with ACL support? You could either tunnel it through SSH/VPN, or use NFSv4 which supports encryption on its own.

Related Solutions

Is it possible to create a “negative” ACL

Sure, to demonstrate, as root...

touch /tmp/test
setfacl -m u:jdoe:--- /tmp/test
getfacl /tmp/test
su - jdoe
cat /tmp/test
exit
rm /tmp/test

It could be done to every file in a directory by default as well:

mkdir /var/data/not-for-jdoe
setfacl -m u:jdoe:--- /var/data/not-for-jdoe
setfacl -d -m u:jdoe:--- /var/data/not-for-jdoe

Above, the -m switch is the mask and the -d switch makes it the default mask for all new filesystem objects in the directory. The --- can have other permission values, e.g.:

rwx
r--
rw-
r-x
7
4
6
5

The group and other masks work the same way: g:groupname:--- or in combination: u:username:---,g:groupname:---,o::---. Not specifying a username or group name applies the mask to current user/group ownership.

Ssh – set umask for sshfs-mounted filesystem

sshfs is using sftp under the hood and the umask for creation new files is handled by the remote sftp-server. You can set umask as an argument to the sftp-server in /etc/ssh/sshd_config on the server, such as

Subsystem sftp /usr/lib/openssh/sftp-server -u 027     # Debian/Ubuntu

Subsystem sftp /usr/libexec/openssh/sftp-server -u 027 # RHEL/Fedora

Subsystem sftp /usr/lib/ssh/sftp-server -u 027         # Arch

The umask settings and extended ACL are not transferred through the SFTP protocol as implemented by openssh. Also note that there is no "umask on files", but umask is always associated with running process creating the files.

Best Answer

Related Solutions

Is it possible to create a “negative” ACL

Ssh – set umask for sshfs-mounted filesystem

Related Question