Previous post explaining SFTP containment: http:\/\/blog.ls-al.com\/sftp-containment-solaris-10\/<\/p>\n
That solution does not work in a clustered environment. Since then I did also play with loop back (LOFS in Solaris) mounts to a NFS folder. That also works but it had issues being in the vfstab at boot time.<\/p>\n
Below is my final solution:<\/strong> Make direct automount<\/strong> # svcadm refresh autofs Ensure match in sshd correct folder<\/strong> Folders and permissions<\/strong> Check soft link<\/strong> Test client<\/strong> Can check sftp issues here.<\/strong><\/p>\n For example sftp containment does not work if root does not own top levels. Previous post explaining SFTP containment: http:\/\/blog.ls-al.com\/sftp-containment-solaris-10\/ That solution does not work in a clustered environment. Since then I did also<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14,21],"tags":[],"class_list":["post-1006","post","type-post","status-publish","format-standard","hentry","category-solaris","category-ssh"],"_links":{"self":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts\/1006","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/comments?post=1006"}],"version-history":[{"count":0,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts\/1006\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/media?parent=1006"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/categories?post=1006"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/tags?post=1006"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n- Since i am trying to avoid number of mounts I also used autofs in this case.
\n- Create a NFS share INTERFACES so we can share across multiple nodes.
\n- In order to not add more mounts I did this with autofs. If that does not work on bootup we can can just make a permanent \/etc\/vfstab mount.
\n- In our case the application use the following logical path so we need a soft link to our containment area. Soft link svcaccxfr -> \/opt\/interfaces\/svcaccxfr\/ in application tree.<\/p>\n
\n# grep direct \/etc\/auto_master
\n\/- auto_direct -ro
\n# cat \/etc\/auto_direct
\n\/opt\/interfaces -rw,vers=3 10.2.13.35:\/export\/INTERFACES<\/p>\n
\n# svcadm restart autofs<\/p>\n
\n# tail -10 \/etc\/ssh\/sshd_config
\nMatch User svcxfr
\nChrootDirectory \/opt\/interfaces\/svcxfr
\nAllowTCPForwarding no
\nX11Forwarding no
\nForceCommand internal-sftp -u 017 -l info<\/p>\n
\n# cd \/opt
\n# ls -l | grep interfaces
\ndrwxr-xr-x 3 root root 3 Dec 21 14:12 interfaces
\n# cd interfaces\/
\n# ls -l | grep svcxfr
\ndrwxr-xr-x 3 root root 3 Dec 21 14:13 svcxfr
\n# ls -l | grep svcxfr\/uploads
\n# cd svcxfr\/
\n# ls -l | grep uploads
\ndrwxrwxr-x 2 ebsppe_a ebsppe 3 Dec 21 14:50 uploads<\/p>\n
\n# cd \/apps\/ebs11i\/appltop\/xxnp\/11.5.0\/interfaces
\n# ls -l | grep interfaces
\nlrwxrwxrwx 1 root root 26 Dec 21 14:14 svcxfr -> \/opt\/interfaces\/svcxfr\/<\/p>\n
\n$ sftp svcxfr@server1
\nPassword:
\nConnected to server1.
\nsftp> dir
\nuploads
\nsftp> cd uploads
\nsftp> put zfsrest_test1.py
\nUploading zfsrest_test1.py to \/uploads\/zfsrest_test1.py
\nzfsrest_test1.py 100% 1934 1.9KB\/s 00:00
\nsftp> exit<\/p>\n
\n# tail -f \/var\/log\/authlog
\nDec 21 14:49:48 server1\u00a0sshd[12790]: [ID 800047 auth.info] Accepted keyboard-interactive for svcxfr from 192.168.38.104 port 39788 ssh2
\nDec 21 14:49:49 server1\u00a0sshd[12790]: [ID 800047 auth.info] subsystem request for sftp
\nDec 21 14:50:04 server1\u00a0sshd[12790]: [ID 800047 auth.info] Received disconnect from 192.168.38.104: 11: disconnected by user<\/p>\n","protected":false},"excerpt":{"rendered":"