Can asyncssh.SFTPServer be used as a standalone subsystem?

[jluebbe]

I'm thinking about using asyncssh.SFTPServer (or SFTPServerHandler) as the server for 'reverse sshfs' (using sshfs -o passive). The main reason would be to restrict the set of files accessible to the remote system (like a chroot).

Can this implementation be connected to pipes, so that it could talk to an sshfs started remotely via ssh?

[ronf]

I don't have a lot of experience with sshfs and its -o passive option, but this is an interesting idea. It looks like that option makes it perform all the SFTP server operations on stdin & stdout. So, in theory, if you were to open an SSH connection and then use conn.open_session() to run "sshfs" on the remote machine, this would give you back an SSHReader and SSHWriter you could pass in to run_sftp_server() with your own custom SFTPServer instance.

For this to work, you'll want to make sure you pass in encoding=None when opening the remote session, so that you get a channel that can handle reading and writing raw binary data.

The biggest issue at the moment is that neither the SFTPServerHandler class or the run_sftp_server() function is exposed in the AsyncSSH public API. However, once I understand better how this would work, I can figure something out on that.

Here's an example that seems to work for me here:

import asyncio, asyncssh, sys

async def run_client() -> None:
    async with asyncssh.connect('remotehost') as conn:
        writer, reader, _ = await conn.open_session('sshfs : /tmp/mnt -o passive', encoding=None)
        server = asyncssh.SFTPServer(writer.channel)
        await asyncssh.sftp.run_sftp_server(server, reader, writer, 6)

try:
    asyncio.run(run_client())
except (OSError, asyncssh.Error) as exc:
    sys.exit('SSH connection failed: ' + str(exc))

This uses the standard SFTPServer class to make the current directory of the Python process available on the remote system at the mount point /tmp/mnt. If you specify a directory after the ':' in the sshfs command, it will make that directory available instead. You should also be able to make your own subclass of SFTPServer and pass that in if you want to customize any of the responses to the filesystem requests made by sshfs.

There's a bit of ugliness here where you have to pass in a channel object when instantiating the SFTPServer object. This is normally hidden, and is used to allow access to environment variables set by the client when accepting connections as a (forward direction) SFTP server. It doesn't really make sense in this case, though. You may be able to just pass in None here, and have everything work if your never access self.channel, self.connection, or self.env of the SFTPServer object, but I haven't specifically tested that.

Also, there's currently a requirement that you pass in the SFTP version to run_sftp_server(). Typically, this would be a value between 3 and 6. I'd probably give this a default value if I created a proper wrapper for this case.

Let me know if this is what you were looking for... It turned out to be more straightforward than I expected!