Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

How to restrict a Linux user to his home directory only when he SFTP in?

Posted on 2014-10-16
2
Medium Priority
?
507 Views
Last Modified: 2014-10-19
The following is at the end of my "/etc/ssh/sshd_config"...
Subsystem sftp internal-sftp

Match Group sftponly
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no

Open in new window

I have a group called sftponly with gid 562.
I've added userabc to this group and the following is his entry in /etc/passwd...
userabc:x:527:562:User description goes here:/home/userabc:/bin/false
I've restarted sshd.
"/home" and "/home/userabc" is owned by root:root and permissions for both folder is 755/
Below is the output when I try to SFTP in to the server using userabc...
Status:	Connecting to xxx.xxx.xxx.xxx...
Response:	fzSftp started
Command:	open "userabc@xxx.xxx.xxx.xxx" 22
Command:	Pass: ********
Status:	Connected to xxx.xxx.xxx.xxx
Status:	Retrieving directory listing...
Command:	pwd
Response:	Current directory is: "/"
Command:	ls
Status:	Listing directory /
Error:	Unable to open .: permission denied

Open in new window

May I know, what am I missing here? Thanks!
0
Comment
Question by:killdurst
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 68

Accepted Solution

by:
woolmilkporc earned 1500 total points
ID: 40386248
Hi,

the user's home directory is relative to the chroot directory. That's because sshd changes the working directory to the user's home directory after the chroot.

So sshd tries to change to "/home/userabc/home/userabc", a directory which might not exist or have the wrong permissions on your machine. Maybe that's the cause of your issue.

OK, sftp should be able to "ls" the chroot directory, the one where sshd will change to when $HOME is not found under the chroot path nevertheless ...

Anyway, better create a directory /home/userabc/userabc with the low-level "userabc" directory being owned and writeable by userabc, then change the home directory in /etc/passwd to "/userabc" and change the chroot directory in sshd_config from "%h" to "/home/%u".

Alternatively, create a root-owned, only-root-writeable directory /home/sftpusers, make this the chroot directory and create user-owned directories corresponding to your usernames below it. The users' home directories should then become "/username".
0
 
LVL 7

Assisted Solution

by:Stampel
Stampel earned 500 total points
ID: 40386881
Thats right. Just be warned if it does not work be aware that it is not working on slightly old versions of OpenSSH
0

Featured Post

NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you have a server on collocation with the super-fast CPU, that doesn't mean that you get it running at full power. Here is a preamble. When doing inventory of Linux servers, that I'm administering, I've found that some of them are running on l…
In part one, we reviewed the prerequisites required for installing SQL Server vNext. In this part we will explore how to install Microsoft's SQL Server on Ubuntu 16.04.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Suggested Courses

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question