Solved

How to restrict a Linux user to his home directory only when he SFTP in?

Posted on 2014-10-16
2
475 Views
Last Modified: 2014-10-19
The following is at the end of my "/etc/ssh/sshd_config"...
Subsystem sftp internal-sftp

Match Group sftponly
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no

Open in new window

I have a group called sftponly with gid 562.
I've added userabc to this group and the following is his entry in /etc/passwd...
userabc:x:527:562:User description goes here:/home/userabc:/bin/false
I've restarted sshd.
"/home" and "/home/userabc" is owned by root:root and permissions for both folder is 755/
Below is the output when I try to SFTP in to the server using userabc...
Status:	Connecting to xxx.xxx.xxx.xxx...
Response:	fzSftp started
Command:	open "userabc@xxx.xxx.xxx.xxx" 22
Command:	Pass: ********
Status:	Connected to xxx.xxx.xxx.xxx
Status:	Retrieving directory listing...
Command:	pwd
Response:	Current directory is: "/"
Command:	ls
Status:	Listing directory /
Error:	Unable to open .: permission denied

Open in new window

May I know, what am I missing here? Thanks!
0
Comment
Question by:killdurst
2 Comments
 
LVL 68

Accepted Solution

by:
woolmilkporc earned 375 total points
ID: 40386248
Hi,

the user's home directory is relative to the chroot directory. That's because sshd changes the working directory to the user's home directory after the chroot.

So sshd tries to change to "/home/userabc/home/userabc", a directory which might not exist or have the wrong permissions on your machine. Maybe that's the cause of your issue.

OK, sftp should be able to "ls" the chroot directory, the one where sshd will change to when $HOME is not found under the chroot path nevertheless ...

Anyway, better create a directory /home/userabc/userabc with the low-level "userabc" directory being owned and writeable by userabc, then change the home directory in /etc/passwd to "/userabc" and change the chroot directory in sshd_config from "%h" to "/home/%u".

Alternatively, create a root-owned, only-root-writeable directory /home/sftpusers, make this the chroot directory and create user-owned directories corresponding to your usernames below it. The users' home directories should then become "/username".
0
 
LVL 7

Assisted Solution

by:Stampel
Stampel earned 125 total points
ID: 40386881
Thats right. Just be warned if it does not work be aware that it is not working on slightly old versions of OpenSSH
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SSH (Secure Shell) - Tips and Tricks As you all know SSH(Secure Shell) is a network protocol, which we use to access/transfer files securely between two networked devices. SSH was actually designed as a replacement for insecure protocols that sen…
It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now