sFTP: Restrict SSH users

[^rooker]

This HowTo shows how to setup a Debian/Ubuntu based Linux server in a way that allows some users to have full SSH access, while others can only access their home folders by sFTP.

NOTE: The first steps (1-3) must only be executed once per system.

1) Create the group "ftpusers"

Code: Select all

$ groupadd -r ftpusers

2) Add "sftp-server" binary as shell:
As root run:

Code: Select all

$ echo "/usr/lib/sftp-server" >> /etc/shells

3) Modify your sshd_config for chroot:
Add the following block to your /etc/ssh/sshd_config file:

# Restrict FTP-only users:
Match Group ftpusers
ChrootDirectory /home/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

Don't forget to restart your sshd for these changes to take effect:

Code: Select all

$ service ssh restart

4) Create a new user
...and add it to "ftpusers", and change its shell to "sftp-server".

Code: Select all

$ usermod -a -G ftpusers USERNAME
$ usermod -s /usr/lib/sftp-server USERNAME

Then set root as the owner of the USERNAME's home folder. This is required for chroot to work.

Code: Select all

$ chown root ~USERNAME
$ chmod 755 ~$USERNAME

That should be it.
Now you can serve sFTP accounts without worrying about users wandering around on your server...

Links:

• https://serverfault.com/questions/34170 ... irectories
• https://serverfault.com/questions/66016 ... ver#660325
• https://debian-administration.org/artic ... ead_of_SSH
• https://www.ccs.uky.edu/machines/sftp.html
• https://debian-administration.org/artic ... tDirectory

[^rooker]

If you intend to write a BASH script for creating new users like that, here's how you get the HOME folder of another user:

Code: Select all

HOME=$(eval echo ~"$USERNAME")

[^rooker]

If an error message like this appears when trying to login over sFTP, then things are not correctly configured:

Connection reset by peer
Could not connect to server

In /var/log/auth.log, a corresponding entry could look like this:

fatal: bad ownership or modes for chroot directory "/home/USERNAME"

The chroot target directory must be owned by root - and there must not be group write permissions to that folder.

Links:

• https://askubuntu.com/questions/134425/ ... mes#134442
• http://lists.mindrot.org/pipermail/open ... 27651.html