MySecureShell is a solution which has been made to bring more features to sftp/scp protocol given by OpenSSH.

By default, OpenSSH brings a lot of liberty to connected users which imply to trust in your users. The goal of

MySecureShell is to offer the power and security of OpenSSH, with enhanced features (like ACL) to restrict

connected users.

MySecureShell was created because of the lack of file transfer features in OpenSSH. OpenSSH was not designed as a

file transfer solution, that’s why we made MySecureShell.

If you’re wondering why you should take MySecureShell as an SFTP server instead of a classical FTP, there are several

reasons:

Is MySecureShell really add enhanced features to OpenSSH sftp? Yes! Here is a sample of features of what MySe-

MySecureShell has been developed to work on several types of Operating Systems like Linux, Mac OS X, Solaris,

BSD and Windows (with Cygwin).

We unfortunately do not package MySecureShell for all platforms but we do our best to bring binary packages to most

used/common Operating System for production usage like:

You’re now ready to install MySecureShell:

First, add the repository lines in /etc/yum.repos.d/mysecureshell.repo:

*

*

*

MySecureShell is available by default in Debian Jessie. To install it:

Then import the GPG repository key:

You’re now ready to install MySecureShell:

First, add the repository lines in /etc/apt/sources.list.d/mysecureshell.list:

*

*

You’re now ready to install MySecureShell:

First, add the repository lines in /etc/yum.repos.d/mysecureshell.repo:

If you want to use the latest version of MySecureShell, the simplest way is to use brew tool.

First, install brew:

You’re now ready to install MySecureShell:

First import the GPG repository key:

You’re now ready to install MySecureShell:

First import the GPG repository key:

Then, add the MySecureShell repository lines:

You’re now ready to install MySecureShell:

Then prepare the sources with the configure command:

If everyhtings went fine, you should have something like this:

You can now launch the compilation:

To configure MySecureShell, you need to edit the /etc/ssh/sftp_config file. By default MySecureShell comes with a

commented example configuration. This may not match all your needs and you will need to modify it to get it working

as expected.

The configuration is made with 2 importants kinds of tags:

Configuration files should looks like this:

<Default> CallbackUpload “env”

</Default>

<Default> CallbackUpload “/bin/my-script.sh $LAST_FILE_PATH”

</Default>

If enabled, a user or set of users, won’t be able to change permissions on files and directories.

Charset null United States 0.8 Default

true

Here we want to hide all users the files and folders real groups, but not for the admin user:

This tag fakes the user owner by visually changing the real user name of files and folders by the user name of the

connected user. This can be used for security reasons when you don’t want connected users to see real permissions.

Here is an easy way to disable accounts for a user or a set of users. This can be useful if you need to disable accounts

quickly. Only new connections will be deny, current open ones won’t be automatically closed.

This tag, deny to the connected user to create folders.

This tag, deny to the connected user to overwrite onto an existing file.

DisableOverwrite false false 1.20 Default,Group,IpRange,User,VirtualHost

This tag, deny to the connected user to read folders content.

DisableReadDir false false 1.20 Default,Group,IpRange,User,VirtualHost

true

This tag, deny to the connected user to read files content.

This tag, deny to the connected user to remove directories.

This tag, deny to the connected user to remove files.

true

This tag, deny to the connected user to rename files or folders.

DisableRename false false 1.20 Default,Group,IpRange,User,VirtualHost

true

IgnoreHidden false false 0.1 Default,Group,IpRange,User,VirtualHost

true

If you want to hide all files and folders starting with a dot file (eg: .DsStore):

And then, in /etc/ssh/mysecureshell/my_sftp_config_file file, you can add configuration content.

IsAdmin tag grants to a user or a set of users, admins permissions. That means they can administrate MySecureShell

throught sftp-admin CLI or with MySecureShell GUI.

IsAdmin false false 0.7 Default,Group,IpRange,User,VirtualHost

true

If you want to grant to admins group the administrative rights:

IsSimpleAdmin false false 1.0 Default,Group,IpRange,User,VirtualHost

true

If you want to grant to simpleadmins group the administrative rights:

You can limit the number of maximum simultaneous connections per incoming IP address.

You can limit the number of maximum simultaneous connections per username.

LimitConnectionByUser 0 (unlimited) integer 0.1 Default,Group,IpRange,User,VirtualHost

Here we want to limit the total maximum connections to 8. However per username connections, it is restricted to 1

connection:

LogFile /var/log/sftp_server.log path 0.95 Default,Group,IpRange,User,VirtualHost

In this example, we separate the default log location and a virtual host log location:

LogLevel 6 (all) 0 (no log) 2.01 Default,Group,IpRange,User,VirtualHost

1 (show connexion)

2 (show transfert)

3 (show error)

4 (show warning)

5 (show info)

6 (show debug)

Write logs to Syslog. If you want to know more on Syslog, you can follow the link.

LogSyslog false false 1.33 Default,Group,IpRange,User,VirtualHost

true

If you want to enable syslog loging:

MinimumRights null XXXX YYYY 1.0 Default,Group,IpRange,User,VirtualHost

You can limit the number of simultaneous opened files with that tag.

MaxOpenFilesForUser 0 (unlimited) integer 0.3 Default,Group,IpRange,User,VirtualHost

If you want to limit to 5, the number of simultaneous opened files for a user:

MaxReadFilesForUser 0 (unlimited) integer 0.3 Default,Group,IpRange,User,VirtualHost

If you want to limit to 5, the number of simultaneous read files for a user:

You can limit the number of simultaneous write files with that tag.

MaximumRights null XXXX YYYY 1.20 Default,Group,IpRange,User,VirtualHost

In this example, we do not want users to be able to restrict too much access. So the minimum allowed permissions are

0640 for files. And we want to restrict at minimum to 0750 to new created folders to the owner and the group only:

PathAllowFilter null regex 1.20 -> 1.25 Default,Group,IpRange,User,VirtualHost

You can allow filetering only images extensions files like this:

In most of basic situations, you generally want:

Here is a configuration with commented examples:

For this use case, let’s say you have multiple hosted clients and you have to manage their platforms. You want to:

We can see here 2 different VirtualHost which have their own home directory and logs file. They both inherit their

configuration from the Default parent tag. However www.exemple.fr virtual host has a different configuration for

the maximum of simultaneous connected users.

In the Download folder, read only files and folders will be present while in the Upload folder, users will be able to

upload anything. Here is what it should looks like:

As an administrator, you have to tasks to know to manage your users and validate the configuration.

You can easily add a new user to MySecureShell by using the sftp-user command:

This will create the user and password, then add MySecureShell shell to this user.

Note: sftp-user uses the common binary tool to create users (useradd on Linux and niutil on Mac OS).

You can also delete a user or getting the list of avaialable users:

We are providing Docker and Vagrant files that will install everything you need to have (packages, sources, dependan-

With Docker, here is the content file for development: