8

I am working with OpenSSH downloaded from https://github.com/PowerShell/Win32-OpenSSH/releases.

My goal here is to setup an ssh server that allows sftp files transfer without ssh access. According to the official documentation provided by OpenSSH, this should be supported on Windows since version 7.7. was released and the restriction should be set up in sshd_config and I tried to play with this file for a while, but I wasn't able to restrict myself to be able to only access the subfolders, this is what I have in my config file added:

Subsystem   sftp    sftp-server.exe
ForceCommand internal-sftp 
ChrootDirectory c:\users\myusername 
AllowTcpForwarding no 
PermitTunnel no
GatewayPorts no

Can anyone tell me why this is not working? Or I cannot setup SFTP access only like this?

Another option would be to disable SSH connection. How do I achieve that with OpenSSh in Windows?

Improve this question
3
  • 1
    The OpenSSH Windows feature does not support everything that OpenSSH supports However, your question isn't clear, so I am having difficulty understanding your question. Please edit your question instead of replying with a comment.
    – Ramhound
    May 7, 2020 at 13:45
  • Please clarify what you currently can do that you don't want sftp clients doing. Viewing files in other folders? Connecting to SSH?
    – Cpt.Whale
    May 8, 2020 at 20:01
  • @user19702 please view my edited question. Thank you.
    – Tomáš Johnbík
    May 11, 2020 at 6:56

2 Answers 2

Reset to default
7

From Mika-n on the PowerShell-OpenSSH GitHub:

This works with OpenSSH-Win64 8.1.x version, but you need to set following sshd_config options (by default in %PROGRAMDATA%\SSH\ folder location in Windows platform):

ForceCommand internal-sftp 
Subsystem  sftp   sftp-server.exe -d "D:\MyDataRoot\" 
ChrootDirectory D:\MyDataRoot

PermitTunnel no 
AllowAgentForwarding no 
AllowTcpForwarding no
X11Forwarding no 
AllowUsers sftpuser

So consider adding the subsystem line with -d to set the folder, or add -d to your ForceCommand entry.

Please note that you should also make sure the users have the correct filesystem permissions to keep them contained in a folder as well.

Improve this answer
3
  • My question might be very unfortunate. The ultimate goal, to which I would like to get to, is to disable ssh connection, so I can't connect using ssh and putty, but at the same time I would like to have sftp access, so I can transfer files to my remote server. Since I won't be the only one using this option and it is very hard to change the directories structure on the remote system, I would prefer if this could be done without creating new folder with special permissions and adding current users to a special group with those permissions. Do you think this could be achieve?
    – Tomáš Johnbík
    May 11, 2020 at 8:17
  • I quoted the user, but you can use Subsystem sftp-server.exe -d "C:\users\myusername" in your sshd_config instead. chroot + running sftp with -d (directory) should get you what you need I think. Please add an example of you doing a command that should not be working to clarify more
    – Cpt.Whale
    May 11, 2020 at 14:03
  • In the end I found the issue. I was correcting a wrong config file. What you suggested, works. Thank you.
    – Tomáš Johnbík
    May 12, 2020 at 7:23
3

Here goes what worked for me:

# Forcing SFTP functionality, needed for ChrootDirectory parameter below
ForceCommand internal-sftp 
Subsystem  sftp   sftp-server.exe -d c:\home\

# Specify the default folder the user sees after SFTP authentication. Without this, users will see C:\users\myuser\ as default folder, which is not usually preferable

Match User <domain>\myuser1
ChrootDirectory c:\home\test1\

Match User <domain>\myuser2
ChrootDirectory c:\home\test2\

# Disable tunneling, authentication agent, TCP and X11 forwarding.
# Below parameters are recommended as best practice to prevent certain security bypassing
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
GatewayPorts no
Improve this answer
2
  • 3
    Code without any explanation is useless. Can you elaborate on this a little more?
    – Toto
    Oct 13, 2021 at 10:44
  • I found the code example very useful. It's the first example I've seen that mentions prepending <domain> in Match User, which finally made ChrootDirectory do something! I found this answer helpful as well: serverfault.com/a/1022443/166311.
    – Mark Berry
    Aug 14 at 20:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .