Access restricted via ftp but not ssh using WinSCP

[Paul5]

freenas 9.1.0 or 9.1.1.

Services on CIfS, FTP, Smart and ssh

Simple test set up - Volume=Myvolume user=Alice

Call me Alice for this - If I Alice use WinSCP to login via FTP port 21 I get taken to my home directory = Myvolume all good, I can't go up the tree, but if I instead use SFTP on port 22 to login as Alice, same username and password I get taken to root / and traverse all folders and files. I also tried this on another Windows computer using WinsCP and FileZilla. Same thing.

When I SFTP in I get from the system process display 'Nov 1 06:48:01 freenas sshd[3531]: _secure_path: /mnt/Vol320/Alice/.login_conf is group writeable by non-authorised groups'

I removed all permissions from Alice and she only belongs to her group. Still the same thing, full access to / except no access to her home directory.

Is this a bug for it seems to simple to get in.

As a side note: I did a complete install of 9.1.1 from 9.1.0 not an upgrade and created a new user Alice. I'm still learning. I noticed that I could FTP and SSH into freenas with WinSCP as above but I could not log in through windows network, I changed many permissions to get in. It kept refusing and I still couldn't log in through Windows so I used an old configuration file from 9.1.0 and loaded it. Great I could log in through windows but I can also get access to / using SFTP on port 22.

If it's not a bug what have I done wrong?

 

[dlavigne]

This is a known issue with WinSCP. From the SSH page of the FreeNAS Guide:

NOTE: some utilities such as WinSCP can bypass the chroot. This section assumes that users are accessing the chroot using the command line sftp.

 

[Paul5]

This is a known issue with WinSCP. From the SSH page of the FreeNAS Guide:

NOTE: some utilities such as WinSCP can bypass the chroot. This section assumes that users are accessing the chroot using the command line sftp.

After reading your reply it clicked that I read that somewhere. I also just read your link and it says "you need to make sure other access points are closed, otherwise any user is able to circumvent your restrictions by using them." Does that mean that ftp, sftp should always be off?

 

[panz]

This is a known issue with WinSCP. From the SSH page of the FreeNAS Guide:

NOTE: some utilities such as WinSCP can bypass the chroot. This section assumes that users are accessing the chroot using the command line sftp.

I beg your pardon, but I'm not going to consider "an issue" that another software can bypass security measures of MY OS. This is a fault (bug?) of FreeBSD. IMHO :)

 

[dlavigne]

It is more an issue of mixing apples and oranges. An SSH chroot is designed to chroot console sessions and WinSCP does not create a console session. The clients that were designed to work with SSH (e.g. command line scp or sftp) understand and are limited by the chroot.