I'm trying to set up a file transfer server, which needs to be secured and logged. FTP was suggested, but that feels outdated so I automatically translated that to SFTP (OpenSSH) in my head.
match I can select which users can use the service.
ChrootDirectory I can select which area of the filesystem to publish.
ForceCommand I can limit users to file transfer only and set log level.
Now we get to the wonky part. In order for logging to work there must be a syslog socket available in the chroot.
This strikes me as a completely insane design. How can it ever be safe to give a socket directly connected to the logging system to the users I'm trying to track?