2.1. Docker

Docker is an open platform for developers and sysadmins to build, ship, and run distributed applications. It only works on Linux.

2.1.1. Install prequesites

How does it works? First of all, you need install Docker on your Linux host:

• Docker: easily create containers

2.1.2. Run Dockerfile

Once done, on your machine install the MySecureShell Dockerfile:

$ docker build -t mysecureshell \
https://raw.githubusercontent.com/mysecureshell/mysecureshell/master/deployment-tools/docker/Dockerfile

Here is the content of the Dockerfile:

# =============================================================================
# Stage 1: Build MySecureShell from source
# =============================================================================
FROM debian:bookworm-slim AS builder

ARG MSS_VERSION=""

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        gcc \
        make \
        libc6-dev \
        libacl1-dev \
        libgnutls28-dev \
        curl \
        ca-certificates \
        jq && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /build

# If MSS_VERSION is empty, auto-detect latest release from GitHub API.
# Then download and extract the source tarball.
RUN set -eux; \
    VERSION="${MSS_VERSION}"; \
    if [ -z "$VERSION" ]; then \
        VERSION=$(curl -fsSL https://api.github.com/repos/mysecureshell/mysecureshell/releases/latest | jq -r '.tag_name'); \
    fi; \
    echo "Building MySecureShell $VERSION"; \
    curl -fsSL "https://github.com/mysecureshell/mysecureshell/archive/refs/tags/${VERSION}.tar.gz" \
        | tar xz --strip-components=1

RUN ./configure --prefix=/usr && \
    make all

# =============================================================================
# Stage 2: Runtime image
# =============================================================================
FROM debian:bookworm-slim

LABEL maintainer="Pierre Mavro <deimos@deimos.fr>" \
      org.opencontainers.image.title="MySecureShell" \
      org.opencontainers.image.description="SFTP server with ACL based on OpenSSH" \
      org.opencontainers.image.url="https://github.com/mysecureshell/mysecureshell" \
      org.opencontainers.image.source="https://github.com/mysecureshell/mysecureshell"

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        openssh-server \
        libacl1 \
        libgnutls30 \
        procps \
        whois && \
    rm -rf /var/lib/apt/lists/* && \
    mkdir -p /var/run/sshd && \
    ssh-keygen -A

# Copy compiled binaries directly from builder (bypass install.sh which
# has DESTDIR path mismatches between ETCDIR and MSS_CONF in Docker)
COPY --from=builder /build/mysecureshell           /usr/bin/mysecureshell
COPY --from=builder /build/utils/sftp-who          /usr/bin/sftp-who
COPY --from=builder /build/utils/sftp-state        /usr/bin/sftp-state
COPY --from=builder /build/utils/sftp-admin        /usr/bin/sftp-admin
COPY --from=builder /build/utils/sftp-kill         /usr/bin/sftp-kill
COPY --from=builder /build/utils/sftp-verif        /usr/bin/sftp-verif
COPY --from=builder /build/utils/sftp-user         /usr/bin/sftp-user
COPY --from=builder /build/sftp_config             /etc/ssh/sftp_config
COPY --from=builder /build/man/                    /usr/share/man/

# Set permissions, register shell, create demo user (password: mssuser)
RUN chmod 4755 /usr/bin/mysecureshell && \
    chmod 755 /usr/bin/sftp-who /usr/bin/sftp-verif /usr/bin/sftp-user && \
    chmod 700 /usr/bin/sftp-state /usr/bin/sftp-kill /usr/bin/sftp-admin && \
    echo '/usr/bin/mysecureshell' >> /etc/shells && \
    pass=$(mkpasswd -m sha-512 mssuser) && \
    useradd -m -s /usr/bin/mysecureshell -p "$pass" mssuser && \
    echo 'root:root' | chpasswd

EXPOSE 22

CMD ["/usr/sbin/sshd", "-D"]

2.1.3. Boot the container

You can now launch the Docker container:

$ docker run -d -p 22222:22 mysecureshell

2.1.4. Connect and test

MySecureShell is now ready to serve! From your host machine, you can connect with user mssuser and mssuser for the password:

$ sftp -P 22222 mssuser@127.0.0.1
mssuser@127.0.0.1's password:
Connected to 127.0.0.1.
sftp> ls
sftp> pwd
Remote working directory: /

In parallel, connect from your host machine to the Virtual Machine (root password is root):

$ ssh -p 22222 root@127.0.0.1

and see the current connected user with sftp-who command:

$ sftp-who
--- 1 / 10 clients ---
Global used bandwith : 0 bytes/s / 0 bytes/s
PID: 3389   Name: mssuser   IP:
    Home: /home/mssuser
    Status: idle    Path: /
    File:
    Connected: 2014/08/19 15:38:27 [since 10s]
    Speed: Download: 0 bytes/s [5.00 kbytes/s]  Upload: 0 bytes/s [unlimited]
    Total: Download: 1398 bytes   Upload: 141 bytes

You can see the connected user :-). You can try to upload files to see the result. Of course you can use graphical clients. And if you want to play with the server configuration, look at /etc/ssh/sftp_config.