blob: 75d8d8d532d9ce96dc526919ee0cf5d2af246004 [file] [log] [blame]
Damien Miller426117b2014-07-30 12:33:20 +10001.\" $OpenBSD: sftp-server.8,v 1.26 2014/07/28 15:40:08 schwarze Exp $
Damien Millere4340be2000-09-16 13:29:08 +11002.\"
Ben Lindstrom92a2e382001-03-05 06:59:27 +00003.\" Copyright (c) 2000 Markus Friedl. All rights reserved.
Damien Millere4340be2000-09-16 13:29:08 +11004.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\" notice, this list of conditions and the following disclaimer.
10.\" 2. Redistributions in binary form must reproduce the above copyright
11.\" notice, this list of conditions and the following disclaimer in the
12.\" documentation and/or other materials provided with the distribution.
13.\"
14.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24.\"
Damien Miller426117b2014-07-30 12:33:20 +100025.Dd $Mdocdate: July 28 2014 $
Damien Miller7b28dc52000-09-05 13:34:53 +110026.Dt SFTP-SERVER 8
27.Os
28.Sh NAME
29.Nm sftp-server
30.Nd SFTP server subsystem
31.Sh SYNOPSIS
32.Nm sftp-server
Damien Miller6eaeebf2013-10-15 11:55:57 +110033.Bk -words
Darren Tuckerdb7bf822010-01-09 22:24:33 +110034.Op Fl ehR
Damien Miller502ab0e2013-01-09 15:57:36 +110035.Op Fl d Ar start_directory
Damien Millerfef95ad2006-07-10 20:46:55 +100036.Op Fl f Ar log_facility
37.Op Fl l Ar log_level
Damien Miller6efab272013-10-15 12:07:05 +110038.Op Fl P Ar blacklisted_requests
39.Op Fl p Ar whitelisted_requests
Darren Tucker6b286a42009-10-07 08:46:21 +110040.Op Fl u Ar umask
Damien Miller6eaeebf2013-10-15 11:55:57 +110041.Ek
42.Nm
43.Fl Q Ar protocol_feature
Damien Miller7b28dc52000-09-05 13:34:53 +110044.Sh DESCRIPTION
45.Nm
46is a program that speaks the server side of SFTP protocol
47to stdout and expects client requests from stdin.
48.Nm
49is not intended to be called directly, but from
Damien Miller50a41ed2000-10-16 12:14:42 +110050.Xr sshd 8
Damien Miller7b28dc52000-09-05 13:34:53 +110051using the
52.Cm Subsystem
53option.
Damien Millerfef95ad2006-07-10 20:46:55 +100054.Pp
55Command-line flags to
56.Nm
57should be specified in the
58.Cm Subsystem
59declaration.
Damien Miller7b28dc52000-09-05 13:34:53 +110060See
Darren Tucker1f203942003-10-15 15:50:42 +100061.Xr sshd_config 5
Damien Miller7b28dc52000-09-05 13:34:53 +110062for more information.
Damien Millerfef95ad2006-07-10 20:46:55 +100063.Pp
64Valid options are:
65.Bl -tag -width Ds
Damien Milleraa7ad302013-01-09 15:58:21 +110066.It Fl d Ar start_directory
Damien Miller502ab0e2013-01-09 15:57:36 +110067specifies an alternate starting directory for users.
68The pathname may contain the following tokens that are expanded at runtime:
69%% is replaced by a literal '%',
70%h is replaced by the home directory of the user being authenticated,
71and %u is replaced by the username of that user.
72The default is to use the user's home directory.
73This option is useful in conjunction with the
74.Xr sshd_config 5
75.Cm ChrootDirectory
76option.
Darren Tucker7bee06a2009-10-07 08:47:47 +110077.It Fl e
78Causes
79.Nm
80to print logging information to stderr instead of syslog for debugging.
Damien Millerfef95ad2006-07-10 20:46:55 +100081.It Fl f Ar log_facility
82Specifies the facility code that is used when logging messages from
83.Nm .
84The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
85LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
86The default is AUTH.
Darren Tucker7bee06a2009-10-07 08:47:47 +110087.It Fl h
88Displays
89.Nm
90usage information.
Damien Millerfef95ad2006-07-10 20:46:55 +100091.It Fl l Ar log_level
92Specifies which messages will be logged by
93.Nm .
94The possible values are:
95QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.
96INFO and VERBOSE log transactions that
97.Nm
98performs on behalf of the client.
99DEBUG and DEBUG1 are equivalent.
100DEBUG2 and DEBUG3 each specify higher levels of debugging output.
101The default is ERROR.
Damien Miller6eaeebf2013-10-15 11:55:57 +1100102.It Fl P Ar blacklisted_requests
Damien Miller6efab272013-10-15 12:07:05 +1100103Specify a comma-separated list of SFTP protocol requests that are banned by
Damien Miller6eaeebf2013-10-15 11:55:57 +1100104the server.
105.Nm
106will reply to any blacklisted request with a failure.
107The
108.Fl Q
Damien Miller6efab272013-10-15 12:07:05 +1100109flag can be used to determine the supported request types.
Damien Miller6eaeebf2013-10-15 11:55:57 +1100110If both a blacklist and a whitelist are specified, then the blacklist is
111applied before the whitelist.
112.It Fl p Ar whitelisted_requests
Damien Miller6efab272013-10-15 12:07:05 +1100113Specify a comma-separated list of SFTP protocol requests that are permitted
Damien Miller6eaeebf2013-10-15 11:55:57 +1100114by the server.
115All request types that are not on the whitelist will be logged and replied
116to with a failure message.
117.Pp
118Care must be taken when using this feature to ensure that requests made
Damien Miller6efab272013-10-15 12:07:05 +1100119implicitly by SFTP clients are permitted.
Damien Miller6eaeebf2013-10-15 11:55:57 +1100120.It Fl Q Ar protocol_feature
121Query protocol features supported by
122.Nm .
123At present the only feature that may be queried is
124.Dq requests ,
Damien Miller6efab272013-10-15 12:07:05 +1100125which may be used for black or whitelisting (flags
Damien Miller6eaeebf2013-10-15 11:55:57 +1100126.Fl P
Damien Miller6efab272013-10-15 12:07:05 +1100127and
128.Fl p
129respectively).
Darren Tuckerdb7bf822010-01-09 22:24:33 +1100130.It Fl R
131Places this instance of
132.Nm
133into a read-only mode.
134Attempts to open files for writing, as well as other operations that change
Darren Tucker838891f2010-01-09 22:25:46 +1100135the state of the filesystem, will be denied.
Darren Tucker6b286a42009-10-07 08:46:21 +1100136.It Fl u Ar umask
137Sets an explicit
138.Xr umask 2
139to be applied to newly-created files and directories, instead of the
140user's default mask.
Damien Millerfef95ad2006-07-10 20:46:55 +1000141.El
Damien Miller276571c2008-07-14 12:09:57 +1000142.Pp
Damien Miller426117b2014-07-30 12:33:20 +1000143On some systems,
Damien Miller276571c2008-07-14 12:09:57 +1000144.Nm
145must be able to access
Damien Miller426117b2014-07-30 12:33:20 +1000146.Pa /dev/log
147for logging to work, and use of
Damien Miller276571c2008-07-14 12:09:57 +1000148.Nm
Darren Tucker5837b512009-06-21 17:52:27 +1000149in a chroot configuration therefore requires that
Damien Miller276571c2008-07-14 12:09:57 +1000150.Xr syslogd 8
151establish a logging socket inside the chroot directory.
Damien Miller7b28dc52000-09-05 13:34:53 +1100152.Sh SEE ALSO
Ben Lindstrom160ec622001-04-22 17:17:46 +0000153.Xr sftp 1 ,
Damien Miller7b28dc52000-09-05 13:34:53 +1100154.Xr ssh 1 ,
Darren Tucker1f203942003-10-15 15:50:42 +1000155.Xr sshd_config 5 ,
Damien Miller50a41ed2000-10-16 12:14:42 +1100156.Xr sshd 8
Ben Lindstrom160ec622001-04-22 17:17:46 +0000157.Rs
Ben Lindstrom90fd0602001-06-25 04:45:33 +0000158.%A T. Ylonen
159.%A S. Lehtinen
Ben Lindstrom160ec622001-04-22 17:17:46 +0000160.%T "SSH File Transfer Protocol"
Darren Tucker5d8b7022013-05-16 20:24:23 +1000161.%N draft-ietf-secsh-filexfer-02.txt
162.%D October 2001
Ben Lindstrom160ec622001-04-22 17:17:46 +0000163.%O work in progress material
164.Re
Damien Miller50a41ed2000-10-16 12:14:42 +1100165.Sh HISTORY
166.Nm
Darren Tucker25bd3c02006-09-26 20:14:28 +1000167first appeared in
168.Ox 2.8 .
169.Sh AUTHORS
Damien Millerbf836e52013-07-18 16:14:13 +1000170.An Markus Friedl Aq Mt markus@openbsd.org