Das Werkstatt

This HowTo shows how to setup a Debian/Ubuntu based Linux server in a way that allows some users to have full SSH access, while others can only access their home folders by sFTP.

NOTE: The first steps (1-3) must only be executed once per system.

1) Create the group "ftpusers" 2) Add "sftp-server" binary as shell:
As root run: 3) Modify your sshd_config for chroot:
Add the following block to your /etc/ssh/sshd_config file:

# Restrict FTP-only users:
Match Group ftpusers
ChrootDirectory /home/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

Don't forget to restart your sshd for these changes to take effect: 4) Create a new user
...and add it to "ftpusers", and change its shell to "sftp-server". Then set root as the owner of the USERNAME's home folder. This is required for chroot to work. That should be it.
Now you can serve sFTP accounts without worrying about users wandering around on your server...

Links:

• https://serverfault.com/questions/34170 ... irectories
• https://serverfault.com/questions/66016 ... ver#660325
• https://debian-administration.org/artic ... ead_of_SSH
• https://www.ccs.uky.edu/machines/sftp.html
• https://debian-administration.org/artic ... tDirectory

If you intend to write a BASH script for creating new users like that, here's how you get the HOME folder of another user:

If an error message like this appears when trying to login over sFTP, then things are not correctly configured:

Connection reset by peer
Could not connect to server

In /var/log/auth.log, a corresponding entry could look like this:

fatal: bad ownership or modes for chroot directory "/home/USERNAME"

The chroot target directory must be owned by root - and there must not be group write permissions to that folder.

Links:

• https://askubuntu.com/questions/134425/ ... mes#134442
• http://lists.mindrot.org/pipermail/open ... 27651.html