Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #228524

Re: Qemu 9pfs sftp chrootdirectory option issue

Show all headers | View raw

On 10/28/2020 8:00 PM, john doe wrote:
> On 10/28/2020 7:50 PM, Markus Schönhaber wrote:
>> 28.10.20, 19:19 +0100 john doe:
>>
>>> On 10/28/2020 6:51 PM, Markus Schönhaber wrote:
>>>> 28.10.20, 18:30 +0100 john doe:
>>>
>>>>> $ ls -dl /srv/sftp/9p
>>>>> drwx------ 8 root root ... /srv/sftp/9p
>>>>
>>>> Isn't "9p" supposed to be the share directory? If it is, why is it
>>>> owned
>>>> by root and has these restrictive permissions?
>>>>
>>>
>>> Because of the chrootdirectory directive (see above).
>>
>> That's why I suggested (twice!) to set the ChrootDirectory to the
>> directory that *contains* the share directory.
>>
>>>> Assuming
>>>> ChrootDirectory -> /srv/sftp -> make this root:root, drwxr-xr-x
>>>> share -> /srv/sftp/9p -> make this libvirt-qemu:libvirt-qemu,
>>>> drwxr-xr-x
>>>>
>>>
>>> If I do that, I can't even connect to the sftp server:
>>>
>>> $ sftp sftp9p
>>> packet_write_wait: Connection to ::1 port 22: Broken pipe
>>> Connection closed
>>
>> The logs will probably tell you what exactly is wrong.
>>
>
> Yes the cause of this message is explained by the fatal message
> mentioned in my privious e-mail.
>
> As I'm not able to properly describe the issue I'm facing I will need to
> come at this from an other angle.
>
> Thanks anyway for your help.
>

I managed to get it working by pointing the 'chrootdirective' to a root
own directory, then by mounting the 9p share in a subdirectory of that
directory.
I use the '-d' option to the 'internal-sftp' to make it transparent to
the users connecting to that VM.:


$ cat /etc/ssh/sshd_config
Match ...
         ChrootDirectory /mnt/sftp
         ForceCommand internal-sftp -d sftp

$ls -dl /mnt/sftp
drwxr-xr-x 3 root root 4096 ... /mnt/sftp

$ cat /etc/fstab
sftp_dir /mnt/sftp/sftp 9p trans=virtio,version=9p2000.L

$ ls -dl /mnt/sftp/sftp
drwxr-xrwx 2 64055 64055 4096 ... /mnt/sftp/sftp

Note that I still have not figured out why I need to sed the permission
for 'other' to 'rwx' for it to work or how to restrict access to the
share to a specific 'group'.


On the host I would invoke virt-install as follow:

virt-install --filesystem
type=mount,mode=mapped,source=/mnt/sftp,target=sftp_dir


Thanks to 'Markus Schönhaber <debian-user@list-post.mks-mail.de>' for
his input and for putting me on the right track.

--
John Doe

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Qemu 9pfs sftp chrootdirectory option issue john doe <johndoe65534@mail.com> - 2020-10-20 18:50 +0200
  Re: Qemu 9pfs sftp chrootdirectory option issue Markus Schönhaber <debian-user@list-post.mks-mail.de> - 2020-10-20 20:10 +0200
    Re: Qemu 9pfs sftp chrootdirectory option issue john doe <johndoe65534@mail.com> - 2020-10-21 19:20 +0200
      Re: Qemu 9pfs sftp chrootdirectory option issue Markus Schönhaber <debian-user@list-post.mks-mail.de> - 2020-10-21 23:10 +0200
        Re: Qemu 9pfs sftp chrootdirectory option issue john doe <johndoe65534@mail.com> - 2020-10-28 18:40 +0100
          Re: Qemu 9pfs sftp chrootdirectory option issue Markus Schönhaber <debian-user@list-post.mks-mail.de> - 2020-10-28 19:00 +0100
            Re: Qemu 9pfs sftp chrootdirectory option issue john doe <johndoe65534@mail.com> - 2020-10-28 19:30 +0100
              Re: Qemu 9pfs sftp chrootdirectory option issue Markus Schönhaber <debian-user@list-post.mks-mail.de> - 2020-10-28 20:00 +0100
                Re: Qemu 9pfs sftp chrootdirectory option issue john doe <johndoe65534@mail.com> - 2020-10-28 20:10 +0100
                Re: Qemu 9pfs sftp chrootdirectory option issue john doe <johndoe65534@mail.com> - 2020-11-09 10:00 +0100

csiph-web