Simple restricted scp

Question

I have the requirement to set up some kind of repository that can be read using SCP. Client users shall not be able to see/damage/execute/... anything else.

I read through Restricting an SSH/SCP/SFTP user to a directory and similar, so rssh, scponly, chroot-based methods are known. Also, let's ignore SFTP.

Ideally I'd like not to install anything nor copy around libs etc for a true chroot-based way. So I thought about a shell script like this:

#!/bin/sh

echo "$(date) $*" >> /tmp/scpwrap.log

# Allow only plain SCP get, neither -r nor -v etc
if [ "${1}" = "-c" ] && expr "${2}" : '^scp -f ' >/dev/null
then
  shift

  files=$(echo $1 | sed 's/scp -f //')
  echo "SCPing ${files}" >> /tmp/scpwrap.log

  # However, permit multiple files (e.g. /tmp/x*)
  for f in ${files}
  do
   if [ ! -O "${f}" -o -w "${f}" ]
   then
     echo "Can only get read-only files owned by $(whoami)." >&2
     ls -l "${f}" >> /tmp/scpwrap.log
     exit 1
   fi
  done

  echo "Executing $*" >> /tmp/scpwrap.log
  exec $*
fi

[ "${1}" = "-c" ] && shift
echo "Executing $* not permitted." >&2
exit 1

and then:

# useradd -m -s /tmp/scpwrap.sh scpwrap

If I now copy repo content into ~scpwrap and give it the right ownership/permissions, that could be sufficient to allow:

client$ scp 'scpwrap@reposerver:repo/bla*' /tmp

Looks almost too simple though ... Any concerns or improvements? Many thx!!

Answer 1

Concern: you clearly do not know how to write a secure shell script. Your code is obviously broken because of missing double quotes, which is a security bug, not just a functional bug.

If you actually want this to be secure, don't write your own. As a security engineer I would outright reject your homemade solution since established solutions exist. I'd do this even it didn't look broken at first sight. Use a tool like rssh or scponly. Installing them is less work than writing your own script, and is far more likely to be secure.