X-Recipient: archive-cygwin@delorie.com X-Spam-Check-By: sourceware.org Date: Wed, 19 Nov 2008 12:09:49 +0100 From: Corinna Vinschen To: cygwin@cygwin.com Subject: Re: SFTP doesn't work with ChrootDirectory option set Message-ID: <20081119110949.GE10351@calimero.vinschen.de> Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <49222995.5030609@byu.net> <731070.50337.qm@web34701.mail.mud.yahoo.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <731070.50337.qm@web34701.mail.mud.yahoo.com> User-Agent: Mutt/1.5.16 (2007-06-09) Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Delivered-To: mailing list cygwin@cygwin.com On Nov 18 00:02, TheO wrote: > Actually my real objective is to use chroot for SFTP. I am planning to disable ssh login in the final configuration, I was using ssh just for testing the sshd capability for chrooting. http://cygwin.com/acromyns/#TOFU It's not enough to have a bash in the jailed /bin dir. You need at least a copy of all DLLs the applications (including sftp-server) are using, especially an exact copy of the Cygwin DLL. Having said that... Cygwin, being just another application layer, requires OS support for certain functionality. chroot is one of them. chrooting isn't supported by Windows. All Cygwin is doing is to fake chroot for Cygwin applications, as long as they are playing nice and only use POSIX functions for file access. As soon as they use Win32 functions, the fake is uncovered. Bottom line, you don't get any additional security by using chroot on Cygwin. You're just adding complexity to your setup. Most of the time you can use other measures to restrict the user anyway. Corinna -- Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Project Co-Leader cygwin AT cygwin DOT com Red Hat -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/