Solved

How to restrict a Linux user to his home directory only when he SFTP in?

Posted on 2014-10-16
2
493 Views
Last Modified: 2014-10-19
The following is at the end of my "/etc/ssh/sshd_config"...
Subsystem sftp internal-sftp

Match Group sftponly
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no

Open in new window

I have a group called sftponly with gid 562.
I've added userabc to this group and the following is his entry in /etc/passwd...
userabc:x:527:562:User description goes here:/home/userabc:/bin/false
I've restarted sshd.
"/home" and "/home/userabc" is owned by root:root and permissions for both folder is 755/
Below is the output when I try to SFTP in to the server using userabc...
Status:	Connecting to xxx.xxx.xxx.xxx...
Response:	fzSftp started
Command:	open "userabc@xxx.xxx.xxx.xxx" 22
Command:	Pass: ********
Status:	Connected to xxx.xxx.xxx.xxx
Status:	Retrieving directory listing...
Command:	pwd
Response:	Current directory is: "/"
Command:	ls
Status:	Listing directory /
Error:	Unable to open .: permission denied

Open in new window

May I know, what am I missing here? Thanks!
0
Comment
Question by:killdurst
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 68

Accepted Solution

by:
woolmilkporc earned 375 total points
ID: 40386248
Hi,

the user's home directory is relative to the chroot directory. That's because sshd changes the working directory to the user's home directory after the chroot.

So sshd tries to change to "/home/userabc/home/userabc", a directory which might not exist or have the wrong permissions on your machine. Maybe that's the cause of your issue.

OK, sftp should be able to "ls" the chroot directory, the one where sshd will change to when $HOME is not found under the chroot path nevertheless ...

Anyway, better create a directory /home/userabc/userabc with the low-level "userabc" directory being owned and writeable by userabc, then change the home directory in /etc/passwd to "/userabc" and change the chroot directory in sshd_config from "%h" to "/home/%u".

Alternatively, create a root-owned, only-root-writeable directory /home/sftpusers, make this the chroot directory and create user-owned directories corresponding to your usernames below it. The users' home directories should then become "/username".
0
 
LVL 7

Assisted Solution

by:Stampel
Stampel earned 125 total points
ID: 40386881
Thats right. Just be warned if it does not work be aware that it is not working on slightly old versions of OpenSSH
0

Featured Post

IoT Devices - Fast, Cheap or Secure…Pick Two

The IoT market is growing at a rapid pace and manufacturers are under pressure to quickly provide new products. Can you be sure that your devices do what they're supposed to do, while still being secure?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Google Drive is extremely cheap offsite storage, and it's even possible to get extra storage for free for two years.  You can use the free account 15GB, and if you have an Android device..when you install Google Drive for the first time it will give…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.
Suggested Courses

634 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question