ssh: Disable SFTP subsystem by default

The subsystems daemon option now defaults to an empty list instead
of enabling the SFTP subsystem via ssh_sftpd:subsystem_spec([]).
This extends the "secure by default" principle to also cover SFTP,
complementing the shell and exec default changes.

Previously, all authenticated SSH users had access to the entire
file system visible to the Erlang VM process through the default
SFTP subsystem, with no path restrictions.

Changes:
- Change subsystems default from [ssh_sftpd:subsystem_spec([])] to []
- Update subsystem_spec doc string in ssh.hrl
- Remove dead code in ssh_connection:check_subsystem/2
- Update test suites to explicitly enable SFTP where needed
- Update documentation (hardening.md, introduction.md, using_ssh.md,
  ssh_app.md, terminology.md)

Applications requiring SFTP must now explicitly enable it:

  ssh:daemon(Port, [{subsystems, [ssh_sftpd:subsystem_spec([])]}
                    | Options])

Author: u3s

lib/ssh/doc/guides/hardening.md

@@ -122,7 +122,7 @@ excessive memory consumption.
 
 ### SFTP Server Resource Limits
 
-When running an SFTP server via `ssh_sftpd:subsystem_spec/1`, additional
+When enabling the SFTP subsystem via `ssh_sftpd:subsystem_spec/1`, additional
 resource limits can be configured to protect against resource exhaustion attacks:
 
 #### max_handles
@@ -357,6 +357,10 @@ The negotiation (session setup time) time can be limited with the _parameter_
 
 ## SFTP Security
 
+Note that the SFTP server runs with the file access rights of the OS
+process running the Erlang emulator, regardless of the authenticated
+SSH user. See the [Terminology](terminology.md) section for details.
+
 ### Root Directory Isolation
 
 The `root` option (see `m:ssh_sftpd`) restricts SFTP users to a

lib/ssh/doc/guides/introduction.md

@@ -34,8 +34,9 @@ The `ssh` application is an implementation of the SSH Transport, Connection and
 Authentication Layer Protocols in Erlang. It provides the following:
 
 - API functions to write customized SSH clients and servers applications
-- The Erlang shell available over SSH
-- An SFTP client (`m:ssh_sftp`) and server (`m:ssh_sftpd`)
+- The Erlang shell available over SSH, enabled via the `shell` daemon option
+- An SFTP client (`m:ssh_sftp`) and server (`m:ssh_sftpd`), enabled via the
+  `subsystems` daemon option
 
 ## Prerequisites
 
@@ -114,9 +115,9 @@ the application logic.
 Channels come in the following three flavors:
 
 - _Subsystem_ \- Named services that can be run as part of an SSH server, such
-  as SFTP [(ssh_sftpd)](`m:ssh_sftpd`), that is built into the SSH daemon
-  (server) by default, but it can be disabled. The Erlang `ssh` daemon can be
-  configured to run any Erlang- implemented SSH subsystem.
+  as SFTP [(ssh_sftpd)](`m:ssh_sftpd`). No subsystems are enabled by default.
+  The Erlang `ssh` daemon can be configured to run any Erlang-implemented SSH
+  subsystem.
 - _Shell_ \- Interactive shell. By default the Erlang daemon does not expose the Erlang
   shell. It can be enabled with option `{shell, {shell, start, []}}`
   The shell can be customized by providing your own read-eval-print loop.

lib/ssh/doc/guides/terminology.md

@@ -157,8 +157,9 @@ the server's emulator. The rights in that shell is independent of the just
 authenticated user.
 
 In case of an sftp request, an sftp server is started with the rights of the
-user of the Erlang emulator's OS process. So with sftp the authenticated user
-does not influence the rights.
+user of the Erlang emulator's OS process, provided the SFTP subsystem is
+enabled. So with sftp, the file access rights are those of the OS process
+running the Erlang emulator, regardless of the authenticated SSH user.
 
 So after an authentication, the user name is not used anymore and has no
 influence.

lib/ssh/doc/guides/using_ssh.md

@@ -433,7 +433,8 @@ and `ClientAddress`). See the
 
 ## SFTP Server
 
-Start the Erlang `ssh` daemon with the SFTP subsystem:
+The SFTP subsystem is not enabled by default. To start an SSH daemon with
+SFTP, configure the `subsystems` option explicitly:
 
 ```erlang
 1> ssh:start().

lib/ssh/doc/ssh_app.md

@@ -28,8 +28,9 @@ SSH File Transfer Protocol (SFTP) client and server.
 
 The `ssh` application is an implementation of the SSH protocol in Erlang. `ssh`
 offers API functions to write customized SSH clients and servers as well as
-making the Erlang shell available over SSH. An SFTP client, `ssh_sftp`, and
-server, `ssh_sftpd`, are also included.
+making the Erlang shell available over SSH. An SFTP client (`ssh_sftp`) and
+server (`ssh_sftpd`) are also included. The SFTP server can be enabled via
+the `subsystems` daemon option.
 
 ## Dependencies
 

lib/ssh/src/ssh.hrl

@@ -208,10 +208,13 @@ The `channel_callback` is the module that implements the `m:ssh_server_channel`
 [Creating a Subsystem](using_ssh.md#usersguide_creating_a_subsystem) in the
 User's Guide for more information and an example.
 
-If the subsystems option is not present, the value of
-`ssh_sftpd:subsystem_spec([])` is used. This enables the sftp subsystem by
-default. The option can be set to the empty list if you do not want the daemon
-to run any subsystems.
+If the subsystems option is not present, the default is an empty list
+and no subsystems are enabled.
+
+To enable the SFTP subsystem:
+```
+ssh:daemon(Port, [{subsystems, [ssh_sftpd:subsystem_spec([])]} | Options])
+```
 """.
 -doc(#{group => <<"Daemon Options">>}).
 -type subsystem_spec()        :: {Name::string(), mod_args()} .

lib/ssh/src/ssh_connection.erl

@@ -1505,7 +1505,8 @@ start_subsystem(BinName, #connection{options = Options,
                                      connection_supervisor = ConnectionSup},
 	       #channel{local_id = ChannelId}, _ReplyMsg) ->
     Name = binary_to_list(BinName),
-    case check_subsystem(Name, Options) of
+    Subsystems = ?GET_OPT(subsystems, Options),
+    case proplists:get_value(Name, Subsystems, {none, []}) of
 	{Callback, Opts} when is_atom(Callback), Callback =/= none ->
             %% Exec is not used by subsystems; undefined is filtered
             %% out by channel_cb_init_args/1 so it won't be appended
@@ -1518,26 +1519,6 @@ start_subsystem(BinName, #connection{options = Options,
 	    {error, legacy_option_not_supported}
     end.
 
-
-%%% Helpers for starting cli/subsystems
-check_subsystem("sftp"= SsName, Options) ->
-    case ?GET_OPT(subsystems, Options) of
-	no_subsys -> 	% FIXME: Can 'no_subsys' ever be matched?
-	    {SsName, {Cb, Opts}} = ssh_sftpd:subsystem_spec([]),
-	    {Cb, Opts};
-	SubSystems ->
-	    proplists:get_value(SsName, SubSystems, {none, []})
-    end;
-
-check_subsystem(SsName, Options) ->
-    Subsystems = ?GET_OPT(subsystems, Options),
-    case proplists:get_value(SsName, Subsystems, {none, []}) of
-	Fun when is_function(Fun) ->
-	    {Fun, []};
-	{_, _} = Value ->
-	    Value
-    end.
-
 %%%----------------------------------------------------------------
 %%%
 %%% Send-window handling

lib/ssh/src/ssh_options.erl

@@ -405,7 +405,7 @@ default(server) ->
     (default(common))
         #{
       subsystems =>
-          #{default => [ssh_sftpd:subsystem_spec([])],
+          #{default => [],
             chk => fun(L) ->
                            is_list(L) andalso
                                lists:all(fun(SubSystem = {Name,{CB,Args}}) ->

lib/ssh/test/ssh_algorithms_SUITE.erl

@@ -231,7 +231,9 @@ init_per_group(Tag, Algs, Alg, PA, Config) ->
             end;
 
         _ ->
-            start_std_daemon([{exec, erlang_eval}] ++ [PrefAlgs],
+            start_std_daemon([{exec, erlang_eval},
+                              {subsystems, [ssh_sftpd:subsystem_spec([])]}
+                              | [PrefAlgs]],
                              [{pref_algs,PrefAlgs},
                               {tag_alg,{Tag,[Alg]}}
                               | Config])

lib/ssh/test/ssh_basic_SUITE.erl

@@ -459,6 +459,7 @@ idle_time_common(DaemonExtraOpts, ClientExtraOpts, Config) ->
     UserDir = proplists:get_value(priv_dir, Config),
 
     {Pid, Host, Port} = ssh_test_lib:daemon([{exec, erlang_eval},
+                                             {subsystems, [ssh_sftpd:subsystem_spec([])]},
                                              {system_dir, SystemDir},
 					     {user_dir, UserDir},
 					     {failfun, fun ssh_test_lib:failfun/2}