mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #1230] sftp problem #837
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#837
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @dimsua on GitHub (Apr 17, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1230
Hello
Centos 7
firejail-0.9.44
OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013
ssh/scp work fine, but sftp dont work
sftp -v pNNNN@hosts
OpenSSH_7.4p1, LibreSSL 2.5.0
debug1: Reading configuration data /Users/username/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to username [IP] port 22.
debug1: Connection established.
debug1: identity file /Users/username/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/username/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/username/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/username/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/username/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/username/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/username/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/username/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: Authenticating to username:22 as 'pNNNN'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:RrYTk5FM4DgDX2Q0cRhJsNmfNVU+Wa0eX4/+bXrZm4c
debug1: Host 'username' is known and matches the ECDSA host key.
debug1: Found key in /Users/username/.ssh/known_hosts:186
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/username/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /Users/username/.ssh/id_dsa
debug1: Trying private key: /Users/username/.ssh/id_ecdsa
debug1: Trying private key: /Users/username/.ssh/id_ed25519
debug1: Next authentication method: password
pNNNN@hosts's password:
debug1: Authentication succeeded (password).
Authenticated to host ([IP]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: Sending subsystem: sftp
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
debug1: channel 0: free: client-session, nchannels 1
debug1: fd 0 clearing O_NONBLOCK
Transferred: sent 2264, received 2212 bytes, in 0.2 seconds
Bytes per second: sent 10248.8, received 10013.4
debug1: Exit status 127
Connection closed
On server side:
Apr 17 11:47:28 bk18 sshd[17752]: debug1: subsystem: exec() /usr/libexec/openssh/sftp-server -l INFO
Apr 17 11:47:28 bk18 sshd[17752]: Starting session: subsystem 'sftp' for pNNNN from IP port 52847
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_audit_run_command entering command /usr/libexec/openssh/sftp-server -l INFO
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_request_send entering: type 114
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_request_receive_expect entering: type 115
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_request_receive entering
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_request_receive entering
Apr 17 11:47:28 bk18 sshd[17750]: debug3: monitor_read: checking request 114
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_answer_audit_command entering
Apr 17 11:47:28 bk18 sshd[17750]: debug2: session_new: allocate (allocated 0 max 10)
Apr 17 11:47:28 bk18 sshd[17750]: debug3: session_unused: session id 0 unused
Apr 17 11:47:28 bk18 sshd[17750]: debug1: session_new: session 0
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_request_send entering: type 115
Apr 17 11:47:28 bk18 sshd[17752]: debug2: fd 3 setting TCP_NODELAY
Apr 17 11:47:28 bk18 sshd[17752]: debug3: packet_set_tos: set IP_TOS 0x08
Apr 17 11:47:28 bk18 sshd[17752]: debug2: fd 12 setting O_NONBLOCK
Apr 17 11:47:28 bk18 sshd[17752]: debug2: fd 11 setting O_NONBLOCK
Apr 17 11:47:28 bk18 sshd[17752]: debug2: fd 14 setting O_NONBLOCK
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_forward_audit_messages: entering
Apr 17 11:47:28 bk18 sshd[17753]: debug3: mm_request_send entering: type 124
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_request_receive entering
Apr 17 11:47:28 bk18 sshd[17750]: debug3: monitor_read: checking request 124
Apr 17 11:47:28 bk18 sshd[17753]: debug3: Copy environment: XDG_SESSION_ID=36160
Apr 17 11:47:28 bk18 sshd[17753]: debug3: Copy environment: XDG_RUNTIME_DIR=/run/user/1374
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: read 79 from efd 14
Apr 17 11:47:28 bk18 sshd[17752]: debug3: channel 0: discard efd
Apr 17 11:47:28 bk18 sshd[17752]: debug1: Received SIGCHLD.
Apr 17 11:47:28 bk18 sshd[17752]: debug1: session_by_pid: pid 17753
Apr 17 11:47:28 bk18 sshd[17752]: debug1: session_exit_message: session 0 channel 0 pid 17753
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: request exit-status confirm 0
Apr 17 11:47:28 bk18 sshd[17752]: debug1: session_exit_message: release channel 0
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: write failed
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: close_write
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: send eow
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: output open -> closed
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: read<=0 rfd 12 len 0
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: read failed
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: close_read
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: input open -> drain
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: read 0 from efd 14
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: closing read-efd 14
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: ibuf empty
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: send eof
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: input drain -> closed
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: send close
Apr 17 11:47:28 bk18 sshd[17752]: debug2: notify_done: reading
Apr 17 11:47:28 bk18 sshd[17752]: debug3: channel 0: will not send data after close
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: rcvd close
Apr 17 11:47:28 bk18 sshd[17752]: debug3: channel 0: will not send data after close
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: is dead
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: gc: notify user
Apr 17 11:47:28 bk18 sshd[17752]: debug1: session_by_channel: session 0 channel 0
Apr 17 11:47:28 bk18 sshd[17752]: debug1: session_close_by_channel: channel 0 child 0
Apr 17 11:47:28 bk18 sshd[17752]: debug1: session_close: session 0 pid 0
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_audit_end_command entering command /usr/libexec/openssh/sftp-server -l INFO
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_request_send entering: type 116
Apr 17 11:47:28 bk18 sshd[17752]: debug3: session_unused: session id 0 unused
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: gc: user detached
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: is dead
Apr 17 11:47:28 bk18 sshd[17752]: debug2: channel 0: garbage collecting
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_request_receive entering
Apr 17 11:47:28 bk18 sshd[17752]: debug1: channel 0: free: server-session, nchannels 1
Apr 17 11:47:28 bk18 sshd[17750]: debug3: monitor_read: checking request 116
Apr 17 11:47:28 bk18 sshd[17752]: debug3: channel 0: status: The following connections are open:\r\n #0 server-session (t4 r0 i3/0 o3/0 fd -1/-1 cc -1)\r\n
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_answer_audit_end_command entering
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_session_close: session 0 pid 0
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_session_close: command 0
Apr 17 11:47:28 bk18 sshd[17750]: debug3: session_unused: session id 0 unused
Apr 17 11:47:28 bk18 sshd[17752]: Received disconnect from IP: 11:
Apr 17 11:47:28 bk18 sshd[17752]: debug1: do_cleanup
Apr 17 11:47:28 bk18 sshd[17752]: debug3: PAM: sshpam_thread_cleanup entering
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_request_send entering: type 124
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_request_send entering: type 122
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_request_receive entering
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_request_receive_expect entering: type 123
Apr 17 11:47:28 bk18 sshd[17750]: debug3: monitor_read: checking request 124
Apr 17 11:47:28 bk18 sshd[17752]: debug3: mm_request_receive entering
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_request_receive entering
Apr 17 11:47:28 bk18 sshd[17750]: debug3: monitor_read: checking request 122
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_request_send entering: type 123
Apr 17 11:47:28 bk18 sshd[17750]: debug3: mm_request_receive entering
Apr 17 11:47:28 bk18 sshd[17750]: debug1: do_cleanup
Apr 17 11:47:28 bk18 sshd[17750]: debug1: PAM: cleanup
Apr 17 11:47:28 bk18 sshd[17750]: debug1: PAM: closing session
Apr 17 11:47:28 bk18 sshd[17750]: pam_unix(sshd:session): session closed for user pNNNN
Apr 17 11:47:28 bk18 sshd[17750]: debug1: PAM: deleting credentials
Apr 17 11:47:28 bk18 sshd[17750]: debug3: PAM: sshpam_thread_cleanup entering
sftp-server start without error:
su pNNNN
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
** Note: you can use --noprofile to disable default.profile **
Parent pid 19439, child pid 19440
Child process initialized
[pNNNNN@bk18 ~]$ /usr/bin/firejail -c /usr/libexec/openssh/sftp-server -l INFO
Warning: cannot switch euid to root
Warning: cannot switch egid to root
Warning: cannot switch euid to root
Warning: cannot switch egid to root
Warning: an existing sandbox was detected. /usr/libexec/openssh/sftp-server will run without any additional sandboxing features
Child process initialized
@chiraag-nataraj commented on GitHub (Aug 19, 2018):
Is this still an issue?
@chiraag-nataraj commented on GitHub (May 19, 2019):
Closing due to no response. @dimsua, please feel free to re-open if this is still an issue for you.