How to use sshfs on OpenBSD

Author: Solène

Date: 23 July 2022

Tags: openbsd security

Comment on Mastodon

Introduction

Today we will learn about how to use sshfs, a program to mount a remote directory through ssh into our local file system.

But OpenBSD has a different security model than in other Unixes systems, you can't use FUSE (Filesystem in USErspace) file systems from a non-root user. And because you need to run your fuse mount program as root, the mount point won't be reachable by other users because of permissions.

Fortunately, with the correct combination of flags, this is actually achievable.

sshfs project website

Setup

First, as root we need to install sshfs-fuse from packages.

Permissions errors when mounting with sshfs

If we run sshfs as our user, we will get the error "fuse_mount: permission denied", so root is mandatory for running the command.

But if we run "sshfs server.local:/home /mnt" as root, we can't reach the /mnt directory with our regular user because it's root property:

This confirms sshfs needs some extra flags to be used for non-root users on OpenBSD.

The solution

As root, we will run sshfs to mount a directory from t470-wifi.local (my laptop Wi-Fi IP address on my LAN) to make it available to our user with uid 1000 and gid 1000 (this is the ids for the first user added), you can find the information about your users with the command "id". We will also use the allow_other mount option.

After this command, when I switch to my user whose id and gid is 1000, I can read and write into /mnt.

Credits

This article exists because many OpenBSD users struggle using sshfs, and it's not easy to find the solution on the Internet.

OpenBSD as NAS FOSDEM talk giving an example of sshfs use

= > https://marc.info/?l=openbsd-misc&m=153390693400573&w=2 misc@openbsd.org email thread explaining why fuse mount behavior changed in 2018