How to Setup Chroot SFTP in Linux (Allow Only SFTP, not SSH)
1. Create a New Group
Create a group called sftpusers. Only users who belong to this group will be automatically restricted to the SFTP chroot environment on this system.
# groupadd sftpusers
2. Create Users (or Modify Existing User)
Let us say you want to create an user guestuser who should be allowed only to perform SFTP in a chroot environment, and should not be allowed to perform SSH.
The following command creates guestuser, assigns this user to sftpusers group, make /incoming as the home directory, set /sbin/nologin as shell (which will not allow the user to ssh and get shell access).
# useradd -g sftpusers -d /incoming -s /sbin/nologin guestuser
# passwd guestuser
Verify that the user got created properly.
# grep guestuser /etc/passwd
guestuser:x:500:500::/incoming:/sbin/nologin
If you want to modify an existing user and make him an sftp user only and put him in the chroot sftp jail, do the following:
# usermod -g sftpusers -d /incoming -s /sbin/nologin john
On a related note, if you have to transfer files from windows to Linux, use any one of the sftp client mentioned in this top 7 sftp client list.
3. Setup sftp-server Subsystem in sshd_config
You should instruct sshd to use the internal-sftp for sftp (instead of the default sftp-server).
Modify the the /etc/ssh/sshd_config file and comment out the following line:
#Subsystem sftp /usr/libexec/openssh/sftp-server
Next, add the following line to the /etc/ssh/sshd_config file
Subsystem sftp internal-sftp
# grep sftp /etc/ssh/sshd_config
#Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp
4. Specify Chroot Directory for a Group
You want to put only certain users (i.e users who belongs to sftpusers group) in the chroot jail environment. Add the following lines at the end of /etc/ssh/sshd_config
# tail /etc/ssh/sshd_config
Match Group sftpusers
ChrootDirectory /sftp/%u
ForceCommand internal-sftp
In the above:
- Match Group sftpusers – This indicates that the following lines will be matched only for users who belong to group sftpusers
- ChrootDirectory /sftp/%u – This is the path that will be used for chroot after the user is authenticated. %u indicates the user. So, for john, this will be /sftp/john.
- ForceCommand internal-sftp – This forces the execution of the internal-sftp and ignores any command that are mentioned in the ~/.ssh/rc file.
5. Create sftp Home Directory
Since we’ve specified /sftp as ChrootDirectory above, create this directory (which iw equivalent of your typical /home directory).
# mkdir /sftp
Now, under /sftp, create the individual directories for the users who are part of the sftpusers group. i.e the users who will be allowed only to perform sftp and will be in chroot environment.
# mkdir /sftp/guestuser
So, /sftp/guestuser is equivalent to / for the guestuser. When guestuser sftp to the system, and performs “cd /”, they’ll be seeing only the content of the directories under “/sftp/guestuser” (and not the real / of the system). This is the power of the chroot.
So, under this directory /sftp/guestuser, create any subdirectory that you like user to see. For example, create a incoming directory where users can sftp their files.
# mkdir /sftp/guestuser/incoming
6. Setup Appropriate Permission
For chroot to work properly, you need to make sure appropriate permissions are setup properly on the directory you just created above.
Set the owenership to the user, and group to the sftpusers group as shown below.
# chown guestuser:sftpusers /sftp/guestuser/incoming
The permission will look like the following for the incoming directory.
# ls -ld /sftp/guestuser/incoming
drwxr-xr-x 2 guestuser sftpusers 4096 Dec 28 23:49 /sftp/guestuser/incoming
The permission will look like the following for the /sftp/guestuser directory
# ls -ld /sftp/guestuser
drwxr-xr-x 3 root root 4096 Dec 28 23:49 /sftp/guestuser # ls -ld /sftp
drwxr-xr-x 3 root root 4096 Dec 28 23:49 /sftp
7. Restart sshd and Test Chroot SFTP
Restart sshd:
# service sshd restart
Test chroot sftp environment. As you see below, when gusetuser does sftp, and does “cd /”, they’ll only see incoming directory.
# sftp guestuser@thegeekstuff.com
guestuser@thegeekstuff's password: sftp> pwd
Remote working directory: /incoming sftp> cd /
sftp> ls
incoming
When guestuser transfers any files to the /incoming directory from the sftp, they’ll be really located under /sftp/guestuser/incoming directory on the system.
Note: If you have encountered below error:
Write failed: Broken pipe
Couldn't read packet: Connection reset by peer
Make sure the chroot directory (/sftp/guestuser) has to be owned by root
and can't be any group-write access. Lovely. So you essentially need to turn your chroot into a holding cell and within that you can have your editable content.
Use the following command:
chown root:root /sftp/guestuser
Implement Logging
1. Make syslog available in the chroot
Create a dev directory in each user’s chrooted directory:
# mkdir /sftp/guestuser/dev
The folder permission should be rwxr-xr-x.
2. Configure rsyslog to probe the new logging source
Put the following contents in /etc/rsyslog.conf :
# Create an additional socket for the sshd chrooted users.
$AddUnixListenSocket /sftp/guestuser/dev/log
3. Configure OpenSSH for logging
Modify the following contents in /etc/ssh/sshd_config:
Match Group sftpusers
ChrootDirectory /sftp/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp -f LOCAL7 -l INFO
4. Restart sshd and rsyslog Service
# service sshd restart
# service rsyslog restart
5. Verify file log
Log in to the SFTP server using comfort account
Verify log in /var/log/secure
How to Setup Chroot SFTP in Linux (Allow Only SFTP, not SSH)的更多相关文章
- 如何在Linux中使用sFTP上传或下载文件与文件夹
如何在Linux中使用sFTP上传或下载文件与文件夹 sFTP(安全文件传输程序)是一种安全的交互式文件传输程序,其工作方式与 FTP(文件传输协议)类似. 然而,sFTP 比 FTP 更安全;它通过 ...
- Linux命令之sftp - 安全文件传输命令行工具
用途说明 sftp命令可以通过ssh来上传和下载文件,是常用的文件传输工具,它的使用方式与ftp类似,但它使用ssh作为底层传输协议,所以安全性比ftp要好得多. 常用方式 格式:sftp <h ...
- linux如何搭建sftp服务器
工具/原料 centos7.2_x64 方法/步骤 创建sftp组 groupadd sftp 创建完成之后使用cat /etc/group命令组的信息 2 创建一个sftp用户mysft ...
- java通过sftp对linux服务器文件夹进行操作
本文主要讲sftp对linux服务器的文件和文件夹进行操作,windows server 服务器不支持. package com.lx.ftp; import java.io.File; import ...
- Linux 下创建 sftp 用户并限定目录
Linux 下创建 sftp 用户并限定目录 1.创建 sftpUser 用户组 [root@XXX ~]# groupadd sftpUser 2.创建 sftpUser 用户并指定目录 [root ...
- 我使用过的Linux命令之sftp - 安全文件传输命令行工具
用途说明 sftp命令可以通过ssh来上传和下载文件,是常用的文件传输工具,它的使用方式与ftp类似,但它使用ssh作为底层传输协议,所以安全性比ftp要好得多. 常用方式 格式:sftp <h ...
- linux 上搭建sftp服务
原文链接:https://www.cnblogs.com/yanduanduan/p/9046723.html sftp和ftp的区别 FTP是一种文件传输协议,一般是为了方便数据共享的.包括一个FT ...
- linux传输文件-sftp
SFTP sftp登陆远程服务器 sftp username@ip 例如:sftp mqadmin@10.10.1.150 然后输入password即可 put:上传文件 例如:put iosta ...
- Windows和linux虚拟机之间联网实现SSH远程连接以及VMware的3种网络模式[NAT、桥接和Host-only]
Windows和linux虚拟机之间联网实现SSH远程连接以及VMware的3种网络模式[NAT.桥接和Host-only] 作者:天齐 一.Windows和linux虚拟机之间联网实现SSH远程连接 ...
随机推荐
- python学习笔记--导入tab键自动补全功能的配置
今天开始学习Python,必须配置tab键补全功能 1.首先我们需要查看python的安装路径 [root@abc ~]# python Python 2.6.6 (r266:84292, Jan 2 ...
- iOS开发-javaScript交互
前言 当前混合开发模式迎来了前所未有的发展,跨平台开发.热更新等优点决定了这种模式的重要地位.虽然前端界面在交互.动效等多方面距离原生应用还有差距,但毫无疑问混合开发只会被越来越多的公司接受.在iOS ...
- iOS 9 关键字的简单使用
前言: 在iOS 9 苹果推出了很多关键字, 目的其实很明确, 主要就是提高开发人员的效率, 有益于程序员之间的沟通与交流, 在开发中代码更加规范! 1. nullable 与 nonnull nul ...
- NDK开发之Application.mk文件详解
做过NDK开发的同学应该都知道有个Application.mk文件,这是android NDK构建系统使用的一个可选构建文件.它的目的是描述应用程序需要哪些模块,也定义了所有模块的一些通用变量.主要有 ...
- 探索开发跨平台移动App,谈Jquery Mobile 和PhoneGap应用
随着智能手机等设备的大范围普及,各形各色的移动端软件随之既出.各互联网运营商也都在抢占移动软件的占有率.不惜采用财力进行宣传推广.例如,通过手机淘宝客户端购买物品总比pc端要便宜,360手机助手下载对 ...
- DATABASE LINK 的查看、创建与删除
1.查看dblink SELECT OWNER,OBJECT_NAME FROM DBA_OBJECTS WHERE OBJECT_TYPE='DATABASE LINK'; 或者 SELECT * ...
- 模版引擎(NVelocity)开发
在net中用模版开发,在handler中用到了大量的html代码.为解决这个问题,我可以采用模版引擎(NVelocity)进行开发.1.首先需要将NVelocity.dll文件放入项目,其次引用.2. ...
- 对于百川SDK签名验证的问题
SDK是要在wantu.taobao.com生成的.而生成这个SDK其实是要上传一个apk,而这个上传其实就是取他的签名而已.验证就是那张yw222那张图片.重点是你上传的apk的签名是不是跟你的生成 ...
- Apache Shiro 快速入门教程,shiro 基础教程 (这篇文章非常好)
第一部分 什么是Apache Shiro 1.什么是 apache shiro : Apache Shiro是一个功能强大且易于使用的Java安全框架,提供了认证,授权,加密,和会话管理 ...
- 对select into表复制的一点思考
操作系统:Windows 2007 数据库版本:SQL Server 2008 R2 今天写存储过程遇到一个问题,用"Select 1 id,'Boss_he' into A"这样 ...