Would the OpenSSH upstream accept patches for an unprivileged sshd/sftp-subsystem to make this easier to use their battle tested code?
https://github.com/sandreas/graft
graft serve ./*.txt
will serve every txt file in the current dir...
> graft will prompt for a password, run an sftp server and promote it via zeroconf.
Is that a one time password that will be used by the "receiver" to download the file?
I wrote graft to have a simple portable tool for transfering files in a network without shares - the main idea behind it was to run:
graft serve myfiles/*.txt
on the server side and then
graft receive
on the client side without having to remember the ip or hostname - because zeroconf / mdns is used, it will find the server automatically, if the network is not too big. If there is more than one server, it will prompt you to choose the right one.
I only used SFTP, because it is a secure way to transfer files over the network.
That means that there's no way to authenticate users if you use a password encryption scheme not supported by the bundled modules (like bcrypt for example)
because SSH and SFTP are so closely tied together, a configuration via PAM is pretty hard and inconvenient because creating fake users via PAM for SFTP will also create them for SSH and because there’s no easy way to map all such virtual users to the same user-id. Also, because OpenSSH has zero support for virtual users, aside of a PAM configuration, you also need an NSS configuration and now all your virtual users in some database have suddenly become system users on your box.
SFTP as a protocol on the other hand is very convenient over, say FTP over TLS because it’s using a single TCP port and it has been created this century.
So having this self-contained project is useful when you need to allow third parties access to files but you also don’t want to create system users for them or risk f’ing something up with PAM