Difference between revisions of "Sftp chroot configuration"
Jump to navigation
Jump to search
1) Modify
3) Review privileges from
| Line 6: | Line 6: | ||
| − | 1) Modify <code>[[Subsystem]]</code> to <code>[[internal-sftp]]</code> | + | === 1) Modify <code>[[Subsystem]]</code> to <code>[[internal-sftp]]</code> === |
#Subsystem sftp /usr/lib/openssh/sftp-server | #Subsystem sftp /usr/lib/openssh/sftp-server | ||
| Line 12: | Line 12: | ||
| − | 2) Create a user section at the end of the file (ssh can die respawning if placed after Subsystem line) | + | === 2) Create a user section at the end of the file (ssh can die respawning if placed after Subsystem line) === |
[[Match]] User john | [[Match]] User john | ||
| Line 37: | Line 37: | ||
X11Forwarding no | X11Forwarding no | ||
| − | 3) Review privileges from <code>[[ChrootDirectory]]</code> directory | + | === 3) Review privileges from <code>[[ChrootDirectory]]</code> directory === |
== [[Creating a new user]] == | == [[Creating a new user]] == | ||
Revision as of 11:40, 29 June 2020
Contents
Configuration
/etc/ssh/sshd_config
1) Modify Subsystem to internal-sftp
#Subsystem sftp /usr/lib/openssh/sftp-server Subsystem sftp internal-sftp
2) Create a user section at the end of the file (ssh can die respawning if placed after Subsystem line)
Match User john ChrootDirectory %h ForceCommand internal-sftp AllowTCPForwarding no X11Forwarding no
Others:
- %u (User)
- %h (home directory)
Multiple users:
Match User USER1,USER2
With double Match rule
Match User john LocalPort 2222 ChrootDirectory %h ForceCommand internal-sftp AllowTCPForwarding no X11Forwarding no
3) Review privileges from ChrootDirectory directory
Creating a new user
useradd --create-home USERNAME mkdir -p HOME_USER/.ssh chown chmod og-rx /home/USERNAME/.ssh touch ~/.ssh/authorized_keys && chmod og-r ~/.ssh/authorized_keys
mkdir -p /path/to/directory/upload chmod 777 /path/to/directory/upload
Add user on Match section on sshd_config file
sshd -t systemctl restart sshd
Logs
scp error
protocol error: mtime.sec not present
'Match LocalPort' in configuration but 'lport' not in connection test specification.
Related commands
useradd -m USERNAME
See also
Advertising:
