scponly v1.0 Installation Instructions:

http://sublimation.org/scponly
rumblefish@escapeartist.com

Installing scponly is not difficult.  It is not trivial either so I
advise reading the instructions carefully.  Keep in mind, you CAN
use scponly as a setuid binary, which should warrant caution.

Step 1.  Decide if you want to compile in chroot() functionality.  
	If you dont know what this step means, consult "man chroot".  
	If you still dont understand this question, you should not
	compile with chroot() functionality.  Go to step 2.  

	Otherwise, consider the following:
  - If you do compile with chroot(), your binary will need to be
	setuid.  This should make any security conscious
	administrator wary.  
  - Also consider that scponly will only execute AFTER sshd has
	authenticated the remote user.  Given this, you should be
	able to rest a little easier knowing that utilizing scponly
	will not open you up to impersonal vulnerability subnet scans.
  - If you are still unsure, read the code.  There is a seteuid
	that ensures that the execution of any commands is
	never done with an effective uid of 0.
  - Lastly, I make no gaurantees this code is unexploitable.  Any
	system administrator utilizing scponly bears the full
	responsibility for maintaining a secure system.
  - Without chroot() functionality, scponly still functions just
	fine.  However, most all files on any root filesystem for any
	default installation are globally readable.
  - installing scponly with chroot could incur some pretty hairy
	troubleshooting.  The binaries and libraries must be set
	up properly in the chroot subdirectories properly (see 
	Step 10 below.)  I have provided a simple script to assist
	in this department.  You can simplify this aspect of the 
	installation if you can generate statically linked binaries
	for ls, scp, and sftp-server.

Step 2.  build the binary.  if you want a chroot-enabled binary,
	do the following:

		make scponly_chroot

	otherwise:

		make scponly

	I've built scponly on OpenBSD and Linux, but at present I
	am unaware of any unix systems it wont compile on.  The code
	doesnt utilize anything platform-dependant that I am aware
	of.  (Other than a non-POSIX strsep() call however.)


Step 3. Read the makefile, edit it if you aren't comfortable with
	the installation parameters.  The defaults should be fine.

Step 4. Become root and:

		make install

	This will create your logfile and install your scponly binary.

Step 5. Add scponly to your /etc/shells file, if you have one.  Use
	the full pathname.

		echo /usr/local/sbin/scponly >> "/etc/shells"

Step 6. If you decided on chroot functionality, make your binary
	setuid:

		chmod u+s /usr/local/sbin/scponly

	Ensure the binary is root owned and unwritable by anyone
	else.

Step 7. Create a directory that you want to share all your files
	from. (For the remainder of the examples I will use /pub.)

Step 8. Create a user intended for scponly use.  I will make an
	example of the user "scpdemo".

	Use your system's "adduser" command to create the user.

	Set the default shell to the full pathname of your scponly
	binary.

	Set the home directory to the path decided upon in Step 7,
	which by the way, could be a regular default home directory
	if you want.

	This could look like:

		adduser -d /pub -s /usr/local/sbin/scponly scpdemo

	Lastly, set the password for this user.

ADDITIONAL STEPS FOR CHROOT-ENABLED BINARIES ONLY:


Step 9. You will need to install some directories, passwd files,
	libraries and binaries in your chroot path so that scponly has
	something to invoke when it comes time to execute the remote
	request.

	I have added the script "setup_chroot_dir.sh" in the source
	directory.  

		setup_chroot_dir.sh <chrootdir>

	As per my examples:

		setup_chroot_dir.sh /pub

	This script generates a LIKELY interpretation of the commands
	you will need to execute in order to get chroot() working.
	Inspect the output, edit as you like, then redirect the output
	to a file, chmod u+x the file, and run it as root.

