What:

This is the readme for the make-sftp-jail package, which creates chroot jails for secure ftp (sftp) access
on linux systems.

Blurb:

It has long been accepted that restricted, chrooted, secure ftp (sftp) accounts for users to upload and download files
are preferable to standard, insecure, ftp accounts. Chrooted jails, however, tend to have high administrative,
maintenance, and even storage costs. This package is designed to reduce those costs by automating the process of
building and maintaining chroot jails and by allowing the creation of jails which a shared root directory, using
the following utilities:

1. make-jail-root -- Creates chroot jail directory structure.
2. add-scponly-user -- Creates chroot user accounts.
3. mount-jail-root -- Mounts shared chroot directories into each jail.

Requirements:

This package uses the '--bind' option of mount (8)  which corresponds to the MS_BIND option of mount(2)
in the linux kernel (2.4 and above) and will therefore not work on other operating systems. Both BSD and
Solaris systems are known to have equivalent jail mechanisms.

The sftp-server (8) subsystem of sshd (8), usually built-in. is of course a dependecy.
Note that the sftp-server subsystem is only available in sshd servers with support for the
version 2 ssh protocol.

The scponly program <http://www.sublimation.org/scponly> is needed to provide a restricted user shell.

Installation:

To install the /usr/local prefix, say

  # make install

If you prefer to use the /usr prefix, say

  # make prefix=/usr install

Usage:

. Decide what binaries need to be in the chroot and edit $prefix/etc/chroot-jail-files

. Decide where the shared chroot files will live. They can go anywhere except inside the jail.
  If you choose $prefix/share/jail-root, you can say:

  # install-jail-root $prefix/share/jail-root $prefix/etc/chroot-jail-files

. Add a jail user to the system.

  # add-jail-user username

  The chroot jail will be created in /jail/username and they'll have a shell of scponly.
  The former can be changed by modifying the script, the latter should not be changed
  without a good reason.

. Mount the jail root into the user's directory

  # mount-jail-root $prefix/share/jail-root /jail/username

  This script must be run when the system boots, every time a user is added, and when top level
  directories in the jail-root are modified. It will figure out what has changed and remount correctly.

  If you have a list of jailed usernames, this step could be automated with sometime like:

  for user in `cat user-list`;do mount-jail-root $prefix/share/jail-root /jail/$user ;done
  
. Done

Notes:
  
  This system can be used to create a read-only ftp system, write-only, or normal read-write
  ftp access, based solely on directory permissions.

Author:
  Gyepi Sam <gyepi@praxis-sw.com>
