Solved

How to restrict a Linux user to his home directory only when he SFTP in?

Posted on 2014-10-16
2
468 Views
Last Modified: 2014-10-19
The following is at the end of my "/etc/ssh/sshd_config"...
Subsystem sftp internal-sftp

Match Group sftponly
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no

Open in new window

I have a group called sftponly with gid 562.
I've added userabc to this group and the following is his entry in /etc/passwd...
userabc:x:527:562:User description goes here:/home/userabc:/bin/false
I've restarted sshd.
"/home" and "/home/userabc" is owned by root:root and permissions for both folder is 755/
Below is the output when I try to SFTP in to the server using userabc...
Status:	Connecting to xxx.xxx.xxx.xxx...
Response:	fzSftp started
Command:	open "userabc@xxx.xxx.xxx.xxx" 22
Command:	Pass: ********
Status:	Connected to xxx.xxx.xxx.xxx
Status:	Retrieving directory listing...
Command:	pwd
Response:	Current directory is: "/"
Command:	ls
Status:	Listing directory /
Error:	Unable to open .: permission denied

Open in new window

May I know, what am I missing here? Thanks!
0
Comment
Question by:killdurst
2 Comments
 
LVL 68

Accepted Solution

by:
woolmilkporc earned 375 total points
ID: 40386248
Hi,

the user's home directory is relative to the chroot directory. That's because sshd changes the working directory to the user's home directory after the chroot.

So sshd tries to change to "/home/userabc/home/userabc", a directory which might not exist or have the wrong permissions on your machine. Maybe that's the cause of your issue.

OK, sftp should be able to "ls" the chroot directory, the one where sshd will change to when $HOME is not found under the chroot path nevertheless ...

Anyway, better create a directory /home/userabc/userabc with the low-level "userabc" directory being owned and writeable by userabc, then change the home directory in /etc/passwd to "/userabc" and change the chroot directory in sshd_config from "%h" to "/home/%u".

Alternatively, create a root-owned, only-root-writeable directory /home/sftpusers, make this the chroot directory and create user-owned directories corresponding to your usernames below it. The users' home directories should then become "/username".
0
 
LVL 7

Assisted Solution

by:Stampel
Stampel earned 125 total points
ID: 40386881
Thats right. Just be warned if it does not work be aware that it is not working on slightly old versions of OpenSSH
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Suggested Solutions

Linux users are sometimes dumbfounded by the severe lack of documentation on a topic. Sometimes, the documentation is copious, but other times, you end up with some obscure "it varies depending on your distribution" over and over when searching for …
It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now