Skip to content

Commit 0aec718

Browse files
basejumpbasejump
authored
Merge pull request #4 from yakworks/user-data-mounts
User data mounts
2 parents b93e846 + f8b4b86 commit 0aec718

File tree

13 files changed

+273
-3
lines changed

13 files changed

+273
-3
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
keys

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# SFTP
22

3+
**Forked from atmoz to make it easier to setup on kubernetes. also add fail2ban. merges in PRs to fix a number of issues**
4+
35
![Docker Automated build](https://img.shields.io/docker/automated/atmoz/sftp.svg) ![Docker Build Status](https://img.shields.io/docker/build/atmoz/sftp.svg) ![Docker Stars](https://img.shields.io/docker/stars/atmoz/sftp.svg) ![Docker Pulls](https://img.shields.io/docker/pulls/atmoz/sftp.svg)
46

57
![OpenSSH logo](https://raw.githubusercontent.com/atmoz/sftp/master/openssh.png "Powered by OpenSSH")
@@ -35,6 +37,8 @@ This is an automated build linked with the [debian](https://hub.docker.com/_/deb
3537

3638
# Examples
3739

40+
to run the example in this project `./examples/docker-run.sh`
41+
3842
## Simplest docker run example
3943

4044
```

‎examples/dock-run.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
# run this from the root project
4+
5+
# docker build -t yakworks/sftp .
6+
7+
docker run --name sftp --rm --cap-add=SYS_ADMIN -p 30022:22 \
8+
-v $(pwd)/examples/users.conf:/etc/sftp/users.conf \
9+
-v $(pwd)/examples/sftp-data:/sftp-data \
10+
yakworks/sftp

‎examples/sftp-data/test.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
test file

‎examples/users.conf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# user:pass:uid:gid - if gid is 27 is sudo/admin, 100 is user.
2+
# admin will get data mounted and user with get data/user/%u mounted
3+
foo:FuB4r:1001:27
4+
bar:FuB4r:1002:27
5+
cust:FuB4r:1003:100
6+
cust2:FuB4r:1004:100

‎files/create-sftp-user‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ if [ -n "$gid" ]; then
6565
useraddOptions+=(--gid "$gid")
6666
fi
6767

68+
log "useradd ${useraddOptions[@]} $user"
6869
useradd "${useraddOptions[@]}" "$user"
6970
mkdir -p "/home/$user"
7071
chown root:root "/home/$user"
@@ -97,9 +98,51 @@ if [ -n "$dir" ]; then
9798
if [ ! -d "$dirPath" ]; then
9899
log "Creating directory: $dirPath"
99100
mkdir -p "$dirPath"
100-
chown -R "$uid:users" "$dirPath"
101+
chown -R "$uid:$gid" "$dirPath"
101102
else
102103
log "Directory already exists: $dirPath"
103104
fi
104105
done
105106
fi
107+
108+
###### MODS for bind mounts #####
109+
# mount user dir
110+
dataPath="/sftp-data"
111+
userDataDir="$dataPath/users/$user"
112+
homeDataDir="/home/$user/data"
113+
114+
# always create a data dir by default in the users home.
115+
if [ ! -d "$homeDataDir" ]; then
116+
log "- mkdir -p $homeDataDir"
117+
mkdir -p "$homeDataDir"
118+
chown -R "$uid:$gid" "$homeDataDir"
119+
fi
120+
#mod user so the data dir is their home
121+
usermod -d /data "$user"
122+
123+
if [ -d "$dataPath" ]; then
124+
log "- has $dataPath"
125+
# for users mount the data/users/%u directory
126+
if [ "$gid" = "100" ]; then
127+
if [ ! -d "$userDataDir" ]; then
128+
log "- mkdir -p $userDataDir"
129+
mkdir -p "$userDataDir"
130+
fi
131+
log "- mount --bind $userDataDir $homeDataDir"
132+
# Remember permissions, you may have to fix them:
133+
# chown -R :100 "$userDataDir"
134+
mount --bind "$userDataDir" "$homeDataDir"
135+
#make sure permissions are good on users dir
136+
chown -R :100 "$dataPath"
137+
fi
138+
# for sudo (27) admins mount the data directory
139+
if [ "$gid" = "27" ] ; then
140+
# chown -R :100 "$userDataDir"
141+
mount --bind "$dataPath" "$homeDataDir"
142+
#also make sure that they are assigned to the user group
143+
usermod -g 100 "$user"
144+
usermod -a -G 27 "$user"
145+
fi
146+
chown -R :100 "$dataPath"
147+
chmod -R 775 "$dataPath"
148+
fi

‎files/sshd_config‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,12 @@ AllowTcpForwarding no
1515

1616
# Force sftp and chroot jail
1717
Subsystem sftp internal-sftp
18-
ForceCommand internal-sftp
19-
ChrootDirectory %h
18+
ForceCommand internal-sftp -u 0002 # umask for user|group rwx|rwx permisions
19+
20+
ChrootDirectory /home/%u
21+
22+
# Match Group users
23+
# ChrootDirectory %h
2024

2125
# Enable this for more logs
2226
#LogLevel VERBOSE

‎kubernetes/README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# K8s
2+
3+
Example on how to setup
4+
if setting up for prod run `./scripts/keygen.sh` to create new keys and replace whats in secret-host-keys.yml
5+
6+
kubectl create namespace sftp
7+
kubectl create -f secret-user-conf.yml
8+
kubectl create -f secret-host-keys.yml
9+
kubectl create -f sftp-deploy.yml
10+
11+
clean up
12+
kubectl delete secret sftp-user-conf --namespace=sftp || true
13+
kubectl delete secret sftp-host-keys --namespace=sftp || true
14+
kubectl delete service sftp --namespace=sftp || true
15+
kubectl delete deployment sftp --namespace=sftp || true

‎kubernetes/secret-host-keys.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: sftp-host-keys
5+
namespace: sftp
6+
type: Opaque
7+
stringData:
8+
# This is a sample. generate you own keys as these are not secure and are now public
9+
# scripts/keygen.sh can make new keys, keep them private and safe
10+
ssh_host_ed25519_key: |
11+
-----BEGIN OPENSSH PRIVATE KEY-----
12+
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
13+
QyNTUxOQAAACDB5Z284hLtSd55Pul4d41HsRJOY+LIYyMlc0pvHiBpNQAAAJhiND1WYjQ9
14+
VgAAAAtzc2gtZWQyNTUxOQAAACDB5Z284hLtSd55Pul4d41HsRJOY+LIYyMlc0pvHiBpNQ
15+
AAAECC+YCk6jbhGK1yK4U5UtrYbsd1/95+wditLavq5ja8lMHlnbziEu1J3nk+6Xh3jUex
16+
Ek5j4shjIyVzSm8eIGk1AAAAEXJvb3RAYzUxZWM2YTExYTkzAQIDBA==
17+
-----END OPENSSH PRIVATE KEY-----
18+
ssh_host_ed25519_key.pub: |
19+
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMHlnbziEu1J3nk+6Xh3jUexEk5j4shjIyVzSm8eIGk1 root@c51ec6a11a93
20+
ssh_host_rsa_key: |
21+
-----BEGIN RSA PRIVATE KEY-----
22+
MIIJKAIBAAKCAgEArpN+a6Wrs7TCfydsl8AvmqpDUnJOcn88IpDbjFxpXL0mE/ez
23+
OzMTsY6Omkr9voeW6IIk5eiepmXl9WiqkBFolUmo87Eg738PPuVNj2yMtZXCAFZB
24+
RbuCB01/oBDf8vlYEADq+Ef3GFMDnuBjLSzA1zSxxCLy6qj3VPk0LUtfgkld4PBz
25+
382nBV+N1AAlzLEUGXiK6t9cTvypdyKlmIbuMt+VmGCiyYtgghq86KKrHd4jTiwX
26+
ztKJqPs5oEB5pkrJ203Y6XJf9L9vGNI9rS5nr9NV1fG886TonLhZVKAQRdPsti6W
27+
E/VfX+XxPgLtGo6XD9qoaptk8mbKvfAoPwgAw7yrBk+RTnbiefj2MaBnsgSaBKMl
28+
dSLsCPmOenLJSbDOj8s9+ekrFNB5D9hKJJI+qlcoqQ/iT1LGay00if9jGtzTJvT8
29+
98t3kNZ5yNswklgBcoF777EHYD+0CBDiULqrso0LBMSuxrLxZkR6xNtmvSkawbkj
30+
+W/jUMdbBHetn/zCLMz7V0+4KMvTmDibXEhisRgC3x1M8bi+h+BqRqYTZYL18CFI
31+
ufQmsZpsKRpFqBxu7Q2oBvnQXfm3pMHxfEKdHmfgwFySQDsOaca1WnpE9SownC0F
32+
tiQRkT2cEcU/7/xKJIJWwUQtwSUUzicF348t6RzjhNS5xrxtNYTRsKlVQ+0CAwEA
33+
AQKCAgAvvYH66ilUUYBGyX822IWsJBeY+k1dnlHRmg+QCM1/YPKCz2AiNkuSaMuy
34+
ggN2ERpBpyV0AfMwyfji7aaHE1uoR6Z+TdgV5odCye415JduKPAOq4faC/b5DEZ0
35+
fWjgxzM/3SBkmTmHW1xIHFDCz9REhdJ/Mpd/eIl6oVOVd2E8/ddAZkEp2NFt9L2S
36+
ViAAJAS9GmvS4xYZO5sUS1NBrNSC8QW1z+d0ejsAGVPDwohM+Kxq+j/gfU7L+Te/
37+
DSK3SQh+goFpBbAb/CXjgcsACwqr2H1Grn7fmh9KjFdRfxw0HEpFX+QGvTlBvl4E
38+
eURh2NCSs1cPIEOwzk9vNber1QJwEPs78CQY9KK2lBY053O0zeckY3BLAvzLukPa
39+
bYDlw8xE1MjUBegtwi0wHrLFTwfMQ3MtqkF8hkC+mE90FBjySYCptQ1+7svPnbbC
40+
zr6bG6vG3t760PJGxfm9xuRuqbUu+W8oEP2KvOdizlKynUSySNKHaZth66OJtLI9
41+
sD8VluIJhMKA7xn5sTt9tFOtCe8CoQ99fk05fVOad5+AbtMKhtk1fungR8QlvKtS
42+
p9KflF+QmMT2D4p0mGNXTOc3Sw3sECAaRqIvMRrH0jLm9hQ4sGl03vMeQykxW8r2
43+
Cfmv+JifP7wNI3zx5SNx8aTUHDhD2SDF2JnPvBpc2VJeG/RqeQKCAQEA2yQuZ6t+
44+
tbTnKnBcRabOmkBEOX4ara30ChnCKPun7Jl5u0dBFQHqEDOvkZEX36hv1zfIBTq1
45+
ewQLHu2WXOFzySmcGfj53CIFmkO9Ul/bNn+P7aguw4abPx+jJKKDkr6En2FOdgoU
46+
hiVgED8un5yCLmaMznUwV1C+L0/L6pbHyyz1yA0WKbUJ80qRdVU17yO/R1KBLRzR
47+
/SQqGJ8LlFdRQqE+LP2aLAFTxK2Mj304s5464Q29ieZ8BssCOI333YIOBMSIoDwl
48+
WvMrTJxdW+sO059pTdlkIcgzbADSQcHTSlHoJm2AeVOh94R5zx5PzJl/0WwiBoUK
49+
PgCWKRo9gALQmwKCAQEAy/BrIH2qJfi0ct1aM6KEQpzpUGsRZATDgDBJ/tmOKJ/O
50+
4kJqkeEuCAVZtQppbtXyHlwbupcMfapdpBab0ospDk5zFz+zI5p5ITVwC2i6pA00
51+
YzwW3LB0NSqcDO2lPn9hxVntnPupXp5DFkzixLLlgpAX1RLlOJrz1jzWpAwMTXiG
52+
09mh8X2jae5CReWZJDGm/nQbzkRpD0OFlkkaAtuvUj8092qW2/6p5ocOUCSE6DaV
53+
xcq6C8ZI3kU6vqk/2xqP+OQh7XeW5no/sP7VDUdvBzPZE3QCYqBgv0olMFzqo7v1
54+
gTPjsfB4kRretl5hYPw6McZOXA1dTkHBrFjs+MbyFwKCAQA1kT6WsOEkYbgwM48a
55+
p4/RPOxwcVbsJZ2F6o3/nqSJvWp4UQ6jp/gjRb8hAiqnzXCpV0VZoeRC0dY2FTWw
56+
NpwrDDTQVIAfQ2HDN9PLkwru43e3TGlB+mFwqLckeWVYNaINo6eeSxCBShmVXxxy
57+
f7uCxCafQR4z+dTDk+nwyjLEg5UA9dH5F/v6sLulxtKMRly3fn99G5JpIrH3mskl
58+
1cJTWz7rmIJbR2fGp/W4DZASuBcEdGtkjia7Mly0nl98khIDMFeFc65d8RsgewiH
59+
M4pISKthEEbdyyZmvDypPkv72tG4swO4pKzu6D8uVeaDyPHpq1kV5ud+CH6sRXHL
60+
HOUJAoIBAGBQV9eNYZjzPw1sWpg+LWZkQo/3MMxir43PwHJ6fnfTGVqj8T6Z8Spa
61+
lIY6t5Zftiv+Zh4WDhEfL4A6KTci/63BAPu+2rR61LAJU7Qfrt2hWtdu3oE1WHxv
62+
dilo5nyAnkUc9moINHH6Hkbe4s3wixHBSXAYr2avT28jZl8tTXYc8NgGVUP+iPmT
63+
S3tFNrDwPiS34xXkGxXZVrKmLYGiDMe0ECi1DzAwsj6sE+dnh9k/RjaWSo0bBPjs
64+
CxVWS1EH12y9GQTUUNDidUf64dWWoent45wbUrEPewF8W9neV/Yh4400W1mC7v3g
65+
icPpCOZL2JP/SqyQpzs5NOVXTfsjwdsCggEBALQ74jyWUyLJroHHegSivuTHVRlT
66+
9S2GKH4YItTiy74bLjP1oSY+rIEYrhqiJmJ/Y4z6dve2kPZuLHW2nm92lSo+kg7f
67+
f0kap9jcS1DfwmsCiBIaVqcl6/uAUNiAeAbKBkJ0Y5+TpFNyiTT2i0a+idKG+mS5
68+
DrW0+fbIL2yJKFlDcZ8Fsgf5ckUFL4y4aLD0I503gp03Co84L2zJTzxjE1I9juer
69+
QAp1Gt2IWqad1hhU3cgwLKSjCrAtgTkjPDsm9hcoc6OWASwoz8ax1bg9IUG9ONbA
70+
CgVsC+oR7tFu+3X14Uaj92HG7/mtmiJ6vl0SAfeM2G4rRNIGAZhRveAjAgo=
71+
-----END RSA PRIVATE KEY-----
72+
ssh_host_rsa_key.pub: |
73+
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCuk35rpauztMJ/J2yXwC+aqkNSck5yfzwikNuMXGlcvSYT97M7MxOxjo6aSv2+h5bogiTl6J6mZeX1aKqQEWiVSajzsSDvfw8+5U2PbIy1lcIAVkFFu4IHTX+gEN/y+VgQAOr4R/cYUwOe4GMtLMDXNLHEIvLqqPdU+TQtS1+CSV3g8HPfzacFX43UACXMsRQZeIrq31xO/Kl3IqWYhu4y35WYYKLJi2CCGrzooqsd3iNOLBfO0omo+zmgQHmmSsnbTdjpcl/0v28Y0j2tLmev01XV8bzzpOicuFlUoBBF0+y2LpYT9V9f5fE+Au0ajpcP2qhqm2TyZsq98Cg/CADDvKsGT5FOduJ5+PYxoGeyBJoEoyV1IuwI+Y56cslJsM6Pyz356SsU0HkP2Eokkj6qVyipD+JPUsZrLTSJ/2Ma3NMm9Pz3y3eQ1nnI2zCSWAFygXvvsQdgP7QIEOJQuquyjQsExK7GsvFmRHrE22a9KRrBuSP5b+NQx1sEd62f/MIszPtXT7goy9OYOJtcSGKxGALfHUzxuL6H4GpGphNlgvXwIUi59CaxmmwpGkWoHG7tDagG+dBd+bekwfF8Qp0eZ+DAXJJAOw5pxrVaekT1KjCcLQW2JBGRPZwRxT/v/EokglbBRC3BJRTOJwXfjy3pHOOE1LnGvG01hNGwqVVD7Q== root@c51ec6a11a93

‎kubernetes/secret-user-conf.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: sftp-user-conf
5+
namespace: sftp
6+
type: Opaque
7+
stringData:
8+
users.conf: |
9+
# user:pass:uid:gid - if gid is 27 is sudo/admin, 100 is user.
10+
# admin will get data mounted and user with get data/user/%u mounted
11+
foo:F**B4r:1001:27
12+
bar:F**B4r:1002:27
13+
cust:F**B4r:1003:100
14+
cust2:F**B4r:1004:100

0 commit comments

Comments
 (0)