sftp-user-notes.md

sftp user

So you want to configure an sftp only user?

Setup a group for sftp only users

groupadd sftponly

Make chroot jail directory

For security reasons, one ought to use chroot jailing, which confines a user to the specified directory and its tree, but nothing else.

NOTE: For the chroot jail to work properly, users' home directories (and all directories in the path) must be owned by root, and must not be writable by groups (g-w).

Replace username below with your chosen username. Replace public below with any directory you want to use (e.g. dropbox, incoming).

# make a directory for all sftp users
sudo mkdir /sftp

# make the user's home directory
# note that the user will not be able to write to /sftp/username
sudo mkdir /sftp/username

# make the user's public directory
# this will be writable.
sudo mkdir /sftp/username/public

# set the ownership of the user's public directory
sudo chown username:sftponly /sftp/username/public

Edit sshd_config

Edit /etc/ssh/sshd_config with your favorite editor.

Add the following to the end of the file:

Match Group sftponly
        ChrootDirectory /sftp/%u
        X11Forwarding no
        AllowTcpForwarding no
        ForceCommand internal-sftp

And restart the ssh server. If you're using upstart:

sudo restart ssh

Add the sftp user

Replace username below with your chosen username. Replace public below if you did above.

# add the user
# -g sftponly: sets the group
# -d /username: sets the user's home directory
# -s /usr/sbin/nologin: no shell. (confirm path with `which nologin`)
sudo useradd -g sftponly -d /public -s /usr/sbin/nologin username

# change the user's password (use a long random hash)
sudo passwd username

Et Voila!

ssh connections should not work:

% ssh username@localhost
username@localhost's password:
This service allows sftp connections only.
Connection to localhost closed.
%

sftp connections should work:

% sftp username@localhost
username@localhost's password:
Connected to localhost.
sftp>