Chroot sftp users, remote sftp login shows wrong timestamp on files

Hello,

I have a weird issue, I have RHEL 5.7 running with openssh5.2 where sftpgroup OS group is chroot. I see the difference difference in timestamp on files, when I login via ssh and SFTP, I see four hour difference, is something missing in my configuration.

[root@host1 sftpdata]#pwd
/data/sftphome/sftpuser/sftpdata
[root@host1 sftpdata]# ls -lrt
total 34047
-rw-r--r-- 1 SFTPUSER1 sftpgroup   99853 Sep 24 01:59 file1
-rw-r--r-- 1 SFTPUSER1 sftpgroup     130 Sep 24 01:59 file2
-rw-r--r-- 1 SFTPUSER1 sftpgroup    4339 Sep 24 01:59 file3
-rw-r--r-- 1 SFTPUSER1 sftpgroup 3098614 Sep 24 01:59 file4
-rw-r--r-- 1 SFTPUSER1 sftpgroup 4100287 Sep 24 01:59 file5
-rw-r--r-- 1 SFTPUSER1 sftpgroup 4261072 Sep 24 01:59 file6
[root@host1 sftpdata]#

### when I login remotely via sftp with SFTPUSER1 to host1, I see different timestamp.

$ sftp SFTPUSER1@host1
Connecting to host1...
SFTPUSER1@host1's password:
sftp> ls
sftpdata     backup
sftp> cd sftpdata
sftp> ls -lrt
-rw-r--r--    1 678      600         99853 Sep 24 05:59 file1
-rw-r--r--    1 678      600           130 Sep 24 05:59 file2
-rw-r--r--    1 678      600          4339 Sep 24 05:59 file3
-rw-r--r--    1 678      600       3098614 Sep 24 05:59 file4
-rw-r--r--    1 678      600       4100287 Sep 24 05:59 file5
-rw-r--r--    1 678      600       4261072 Sep 24 05:59 file6
sftp> bye
$

Thanks,

Have you checked if the timezone setting for both the machines are same?

SFTP protocol expects times in UTC, so the server sends in a format which gets misinterpreted by the client, whereas in case of ssh, the commands get executed on the server and the output gets transferred to the client, leaving no chance for misinterpretation.

Yes, I checked both servers are in same time zone.

If I sftp to same server, as a user which is not part for chroot'ed group, I dont see any difference in timestamp, its perfectly the same.

I see this issue only with chroot'ed group users, any idea who to disable this from misinterpreting.

I'm with the TZ concept as well.

grep for TZ in the chroot jail files - they should local copies and not symlinks out of the jail, right?

They are local copies, not sym links.

as suggested I tried grep for TZ, via logging in as sftp remotely, there is no grep command for sftp session.

Well, the timezone information is usually /etc/localtime. Please check if this is a standalone file in the chroot's etc directory (where sftp gets chrooted to) or a symbolic link to the global /etc/localtime

Hello,

Here is existing file localtime in shown below. The Chroot directory under /etc/ssh/sshd_config is pointing users home directory. I did not created and symlinks pointing to localtime.

so your suggesting me cp this file, to /usr/share/zoneinfo/America/New_York to userhome directory and name is it as "localtime" ??

# ls -l /etc/localtime
lrwxrwxrwx 1 root root 36 Jun 14 11:24 /etc/localtime -> /usr/share/zoneinfo/America/New_York
# grep ChrootDirectory /etc/ssh/sshd_config
#ChrootDirectory none
         ChrootDirectory /data/sftphome/%u
#

Thanks

You are almost correct. Just you have to do this:

mkdir /data/sftphome/username/etc
cp /usr/share/zoneinfo/America/New_York /data/sftphome/username/etc/localtime

This should work fine.

Cool, It worked, Thanks.