Restrict SFTP User to Home Directory: Difference between revisions
From Rabbi Blog
m (New page: In this post, I'll show you how to set up secure ftp (SFTP) access to your Ubuntu server. (Instructions for Debian are very similar: leave out the sudo part and follow these steps as root:...) |
(No difference)
|
Revision as of 00:28, 10 December 2010
In this post, I'll show you how to set up secure ftp (SFTP) access to your Ubuntu server. (Instructions for Debian are very similar: leave out the sudo part and follow these steps as root:)
For this to work, you'll need Ubuntu 8.10 "Intrepid", Debian 5.0 "Lenny" or newer. In this example, mark is the user that can gain superuser rights through sudo. "peter" and a few other users are the ones I want to give sftp access to their personal folder, but not shell access or anything else.
Step 1: If it doesn't exist yet, create a group for the users you want to have sftp access only:
sudo groupadd sftponly
Step 2: Add user "peter" to this group:
sudo adduser peter sftponly
Step 3: Install openssh-server if it's not installed yet.
sudo apt-get install openssh-server
Step 4: Open the default OpenSSH server configuration for editing:
sudo nano /etc/ssh/sshd_config
Step 5: Change the default sftp server from:
Subsystem sftp /usr/lib/openssh/sftp-server
to
Subsystem sftp internal-sftp
Step 6: Some users can only use sftp, but not other OpenSSH features like remote login. Let's create a rule for that group of users (we'll create the group afterwards). Add the following section to the bottom of /etc/ssh/sshd_config:
Match group sftponly ChrootDirectory /home/%u X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp
Step 7: Pass ownership of peter's directory you want to be sftp accessible to the superuser:
sudo chown root.root /home/peter
Step 8: Now we change peter's home directory (normally /home/peter) to /:
sudo usermod -d / peter
Step 9: Repeat steps 2, 7 and 8 for any other users that you want to give sftp access.
Step 10: restart sshd
sudo /etc/init.d/ssh restart
Note: to disable the sftp user to use ssh login, change to
sudo usermod -s=/bin/false username
reference: http://blog.markvdb.be/2009/01/sftp-on-ubuntu-and-debian-in-9-easy.html