Configure SFTP server at buildtime and update customization settings. Fixes #2168 #2173
Conversation
…r#2168) and bring SFTP settings to compliance with openSUSE's recommendations. Make SFTP service status persistent across export addition and deletion.
|
@FroggyFlox Thanks for another excellent pull request, much appreciated. I will hopefully be able to look this over shortly. And thanks for taking the trouble to separate the string.format() and black stuff out. Makes the review process a great deal easier. We will hopefully have worked our way around the entire project soon which will be nice. |
|
@FroggyFlox Re:
Nice. I've now, finally, had a change to look at this and all looks to be behaving exactly as you have stated. This is excellent work and definitely ups our sftp game. Thanks for putting so much research/effort into this. Much appreciated. I particularly like the additional restrictions as better to err on that side really. Testing was done via rpms build with this pull request pre-applied to current master (Leap 15.1/15.2beta/15.2 RC, Tumbleweed). The resulting Leap 15.2 RC rpm variant was tested a Leap 15.2 JeOS KVM image build 31.2 fully updated as of today with nothing else pre-installed installed (bar our usual prep like NetworkManager etc. The initrock stuff worked a charm and the extra log stuff is nice to see here. In all cases regular root ssh access (default on our current target distros) was unaffected, this was one of my concerns with changes in this area. Thanks again @FroggyFlox and happy to finally merge this. Apologies for taking so long to get around to it. And thanks for the string.format(), black, and copyright maintenance stuff. |
Fixes #2168
@phillxnet , ready for review.
As detailed in #2168, the SFTP service is ON by default using the wrong subsystem (the default one) and is corrected (correctly configured) only after toggling the service OFF and then back ON.
This PR thus proposes to fix this by defining the correct subsystem during Rockstor's initiation procedure, and ensuring we search for such correct definition while probing for the SFTP service status.
Aims & logic
we currently search for the presence of the
Subsystem sftpstring in/etc/ssh/sshd_configto assess the current status of the SFTP service. Unfortunately, this does not allow for the detection of the correct SFTP subsystem used and leads to surfacing the SFTP service as ON in the webUI despite running with the wrong sftp subsystem (defined by default).This PR proposes to fix this by:
In addition, this PR also takes the opportunity to add per-user customization settings to be in accordance with the settings recommended on hte openSUSE wiki:
https://en.opensuse.org/SDB:SFTP_server_with_Chroot#Match_rule_block
Points of interest
To the best of my tests,
/etc/ssh/sshd_configis configured with the following line by default:Rather than removing it or replacing it with the correct subsystem, I chose to simply comment it out and leave the definition of the correct subsystem to our custom section (below our ROCKSTOR header). This leaves all Rockstor-related customizations together at the end of the file and clearly labeled as such thanks to our header.
Given the string configuring the sftp server in
sshd_configis reused at multiple places in the project, I set it as a build-time variable in the django settings:https://github.com/FroggyFlox/rockstor-core/blob/d8290e52a863ab13683486d311955073e5c02f41/conf/settings.conf.in#L370
Demonstration and functional testing
Upon a fresh build on top of 15.2 ISO Rockstor install, we have the following at the end of
sshd_config:Accordingly, the SFTP service is detected as ON in the webUI:
In order to test the export of shares via SFTP, three new shares are created, each owned by a different user (created through Rockstor):
These three shares are then exported all at once via SFTP. In turn,
sshd_configis updated accordingly:All three shares can be access via SFTP:
As a verification, all shares are created with the respective user as owner:
At that point, turning the SFTP service OFF in the webUI removes the sftp subsystem definition in
/etc/ssh/sshd_config, but leaves all customizations intact:I further tested share export additions and deletions and verified them to be working as intended, maintaining the SFTP service status throughout.
All steps above were also successfully run on Tumbleweed.
Caveats and limitations
As discussed in #2168 (comment), the rsync over ssh functionality is disabled by our enforcing of
ForceCommand internal-sftpfor all exports. I did add a TODO and comment in the code to help with future work to re-enable this feature as custom option surfaced in the webUI:https://github.com/FroggyFlox/rockstor-core/blob/d8290e52a863ab13683486d311955073e5c02f41/src/rockstor/system/ssh.py#L57-L58
@phillxnet, notably, all the work done in
initrock.pywas done assuming the presence of the default (and incorrect) subsystem line insshd_configas well as the absence of any previous Rockstor customizations:https://github.com/FroggyFlox/rockstor-core/blob/d8290e52a863ab13683486d311955073e5c02f41/src/rockstor/scripts/initrock.py#L248
This was done with having in mind the fact that the initrock with this code will be run on system during first time install (and thus free of any prior Rockstor customization). Current Testing users on "Built on openSUSE" might suffer from that, but a toggle OFF/ON of the service should set things in order.
Moreover, in line with the previous paragraph, this part might need further verification of correct behavior at rpm-build time as I'm always nervous about touching
initrock.pyand unsure of how it might behave.Testing
CentOS:
not tested
Leap 15.2 (ISO install):
Ran 205 tests in 82.488s FAILED (failures=5, errors=1)Tumbleweed (ISO install):
Ran 205 tests in 67.063s FAILED (failures=7, errors=1)Full Testing Outputs
Leap15.2 (ISO install)
Tumbleweed (ISO install)