MySecureShell custom configuration

mysecureshell-custom-configuration.md

MySecureShell custom configuration

A simple secure SFTP setup.

New users have disabled bash and similar shells, are allowed to authenticate with password, and are jailed in their home directory.

Configuration

The initial setup to prepare for an easy user management.

SSH

Disable password authentication for all users with an exception for sftp-only group.

1. Create new groups sftp-admin and sftp-client:

   sudo groupadd sftp-admin
   sudo groupadd sftp-client
   

2. Modify the SSH configuration in /etc/ssh/sshd_config file:

   AddressFamily inet
   PermitRootLogin no
   PasswordAuthentication no
   ...
   Match Group sftp-admin
       PasswordAuthentication yes
   Match Group sftp-client
       PasswordAuthentication yes
   

3. Restart the process to apply changes:

   sudo systemctl restart ssh
   

MySecureShell

Setup general connection limitations and default setting for new SFTP users.

1. Modify the MySecureShell configuration in /etc/ssh/sftp_config file:

   <Default>
       GlobalDownload			0
       Download				0
       LimitConnection			100
       LimitConnectionByUser		10
       LimitConnectionByIP			10
       CreateHome				true
       Home				/var/www/$USER
   </Default>
   
   <Group sftp-admin>
       Home				/var/www
   </Group>
   
   <Group sftp-client>
       Home				/var/www/$USER
   </Group>
   

2. Restart the process to apply changes:

   sudo systemctl restart mysecureshell
   

User management

Users bellow have custom SFTP shell and therefore no bash or similar shells.

Create new admin user

Based on previous configuration, this user will have access in all directories.

Note: It is advised to NOT use password authentication for admin users.

1. Create new user NEW-ADMIN-USER:

   sudo sftp-user create NEW-ADMIN-USER
   

2. Add user to sftp-only group:

   sudo usermod -a -G sftp-admin NEW-ADMIN-USER
   

Create new client user

Based on previous configuration, this user will be jailed in /var/www/NEW-CLIENT-USER directory.

1. Create new user NEW-CLIENT-USER:

   sudo sftp-user create NEW-CLIENT-USER
   

2. Add user to sftp-only group:

   sudo usermod -a -G sftp-client NEW-CLIENT-USER
   

List all users

• List all users created and managed with MySecureShell:

  sudo sftp-user list
  

Delete user

• Delete user USERNAME created and managed with MySecureShell:

   sudo sftp-user delete USERNAME