scponly: init at 4.8 #109452
scponly: init at 4.8 #109452
Conversation
|
Please change the titles to |
|
@SuperSandro2000 done, thanks! |
|
This is a semi-automatic executed nixpkgs-review which does not build all packages (e.g. lumo, tensorflow or pytorch) Result of 1 package built:
|
|
@wmertens aren't you supposed to add Also, this is pretty old software now... is it secure? |
|
Ah, I didn't know about shellPath, I just used the direct path to the shell. Indeed, added now. As for security - I could only find CVEs for previous versions and it's still used in Ubuntu, so I reasoned that it is more secure than not having anything. At worst you get shell access, which is only marginally more than just having scp access. |
Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
|
@wmertens awesome! I would love to use this then. What problems did you have with chroot, because that would be great to have working. |
|
@aanderse I tried the following steps:
It didn't seem to make a difference, I was still able to see outside the home directory. Perhaps I was missing a step. I was also wondering if perhaps systemd could provide some sort of user jail but I couldn't find anything. |
|
@wmertens that is too bad. Sounds like it would require some debugging to figure that out. Oh well 🤷♂️ Thanks! |
|
Can this be merged? I can't really tell if the discussions are a merge blocker. |
|
This is a semi-automatic executed nixpkgs-review which does not build all packages (e.g. lumo, tensorflow or pytorch) Result of 1 package built:
|
|
No problems here. Anything I'm talking about could be implemented in a future PR, if ever. |
Motivation for this change
This allows setting the shell of a user to `${pkgs.scponly}/bin/scponly", after which they can only use scp and sftp.
Things done
sandboxinnix.confon non-NixOS linux)./result/bin/)nix path-info -Sbefore and after)