Full Access Locally?

[kamhoe]

I know the risk of having root access via SSH remotely & I agreed with that & I am planning to turn it off.

I use SFTP clients daily, such as WinSCP & FileZilla, locally & remotely from work, by using different ed25519 key authentications for different machines.

I am the only person that have access to TrueNAS & before I turn off the root SSH access, I want to know what is the easiest way to allow me to fully access all my Pools locally?

 

[Ericloewe]

Locally? Just keep using SSH and make sure your user has the right permissions to access the relevant data. Make sure nothing's being forwarded to the SSH port, especially common SSH ports like 22 or 2222.

 

[kamhoe]

Locally? Just keep using SSH and make sure your user has the right permissions to access the relevant data. Make sure nothing's being forwarded to the SSH port, especially common SSH ports like 22 or 2222.

If I understand you correctly, are you suggesting to turn off SSH for Root account & create a new user account for SSH?

Root is the only user for my TrueNAS.

If I create a new user, TrueNAS doesn't allow "/mnt/" as home directory & I won't be able to access all my Pools, right?

Also, I am using a different port for SSH other than 22 or 2222 & nothing else is forwarded to the SSH port.

Thanks.

 

[Ericloewe]

Root is the only user for my TrueNAS.

That generally does not make sense and the expectation is that you'll have non-root users, with the specifics depending on the data, of course.

If I create a new user, TrueNAS doesn't allow "/mnt/" as home directory & I won't be able to access all my Pools, right?

Create symlinks in the user's home directory to wherever you need to go. You're not actually chrooted in there unless explicitly configured as such.

I think we may have some communication issue here, though. "Locally" and "port forward" do not go together, so I'd recommend explaining your needs in a bit more detail, because the advice above is given in the simplistic tone that work well for a local network, but not for the internet.

 

[kamhoe]

That generally does not make sense and the expectation is that you'll have non-root users, with the specifics depending on the data, of course.


Create symlinks in the user's home directory to wherever you need to go. You're not actually chrooted in there unless explicitly configured as such.

I think we may have some communication issue here, though. "Locally" and "port forward" do not go together, so I'd recommend explaining your needs in a bit more detail, because the advice above is given in the simplistic tone that work well for a local network, but not for the internet.

Sorry for the misunderstanding!

Here is my situation, I use SFTP everyday from my home network or remotely from my work. I don't have any problem to access all my Pool1, Pool2, Pool3 with my root account.

But root account isn't recommended for SSH/SFTP & I would like to prevent the risk as much as possible.

So, my question is:
If I create a new user for SSH/SFTP but "/mnt/" is not allowed as the home directory, how can I access all the Pool1, Pool2, Pool3 that located under "/mnt/"?

 

[Ericloewe]

So, my question is:
If I create a new user for SSH/SFTP but "/mnt/" is not allowed as the home directory, how can I access all the Pool1, Pool2, Pool3 that located under "/mnt/"?

As, I said, make whatever symlinks you need.

That said, since this is supposed to happen over the internet, make sure that:

1. Password authentication is disabled
2. TrueNAS is updated
3. You're using some random, obscure port
4. The key pairs are solid and obsolete types (i.e. DSA) are not in use

 

[Patrick M. Hausen]

If I create a new user for SSH/SFTP but "/mnt/" is not allowed as the home directory, how can I access all the Pool1, Pool2, Pool3 that located under "/mnt/"?

Are SFTP users chrooted by default? I think not, so you just navigate around the filesystem as you please ...

 

[Ericloewe]

Are SFTP users chrooted by default? I think not, so you just navigate around the filesystem as you please ...

Nope, not chrooted by default.