User with SCP access can navigate outside of home directory

Help! (Home for newbies)
1

I have a multi-domain webserver using Virtualmin (mostly for Wordpress sites). A single (thankfully trusted) user asked for SFTP access which I granted with an approved IP through FirewallD.

He has reported, and I have confirmed, that if I WinSCP in as this user, though I land in my home directory, I can navigate out of that and at least download things like /etc/passwd (I haven’t tried deleting anything like that but that seems likely from what I am seeing).

How do I lock this user to their own home directory in this case?

SYSTEM INFORMATION
OS type and version Ubuntu 20.04.6
Virtualmin version 7.10.0
2

Of course a user can’t delete anything. Linux is a multi-user system by design. Virtualmin works with the standard UNIX user permissions, by default. Your users can look at non-sensitive stuff (/etc/passwd has no secrets), but can’t cause any harm.

But, Virtualmin also supports jailkit for chrooting ssh users into their home.

image
image1811×1080 156 KB

But, you should be aware of the limitations of a jailed user (they can only run what you grant them permission to run…we have some template jails which include the basics, but you’ll almost certainly want to think about what kinds of things you want users to be able to do and add things to the jail you give them. Virtualmin currently uses Jailkit for this, so it’s worth reading up: Jailkit - chroot jail utilities

Note that Virtualmin 9 (no promises about when this is coming) is getting an overhaul in this area, to offer a Bubblewrap feature. It will likely be enabled by default, as bubblewrap can be much less disruptive than a chroot jail, and it is also actually based on security features (chroot is not a security tool, it is only accidentally shaped like one for some use cases). Because bubblewrap can be safer and can allow most functionality without jumping through hoops, we feel better about enabling it by default.

3

Would this break things? (Note that /sftp-jail does not exist at the beginning of this.)

mkdir -p /sftp-jail/the-user/the-website-in-question.com
chown root:root /sftp-jail
chown root:root /sftp-jail/the-user
chmod 755 /sftp-jail
chmod 755 /sftp-jail/the-user
mount --bind /home/the-website-in-question.com /sftp-jail/the-user/the-website-in-question.com

Edit /etc/ssh/sshd_config with this at the end:

Match User the-user
    ChrootDirectory /sftp-jail/the-user
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

ssh -t

(to check if your ssh config is sane) then:

systemctl reload ssh

When I login this way with WinSCP I am in a folder with only one folder “the-website-in-question.com” which is my website.

Am I now excluded from things I need though?

4

Ah right, never mind that only works for SFTP, not SCP which is what I asked about. Had myself excited there for a minute.