?
Solved

How to restrict a Linux user to his home directory only when he SFTP in?

Posted on 2014-10-16
2
Medium Priority
?
537 Views
Last Modified: 2014-10-19
The following is at the end of my "/etc/ssh/sshd_config"...
Subsystem sftp internal-sftp

Match Group sftponly
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no

Open in new window

I have a group called sftponly with gid 562.
I've added userabc to this group and the following is his entry in /etc/passwd...
userabc:x:527:562:User description goes here:/home/userabc:/bin/false
I've restarted sshd.
"/home" and "/home/userabc" is owned by root:root and permissions for both folder is 755/
Below is the output when I try to SFTP in to the server using userabc...
Status:	Connecting to xxx.xxx.xxx.xxx...
Response:	fzSftp started
Command:	open "userabc@xxx.xxx.xxx.xxx" 22
Command:	Pass: ********
Status:	Connected to xxx.xxx.xxx.xxx
Status:	Retrieving directory listing...
Command:	pwd
Response:	Current directory is: "/"
Command:	ls
Status:	Listing directory /
Error:	Unable to open .: permission denied

Open in new window

May I know, what am I missing here? Thanks!
0
Comment
Question by:killdurst
2 Comments
 
LVL 68

Accepted Solution

by:
woolmilkporc earned 1500 total points
ID: 40386248
Hi,

the user's home directory is relative to the chroot directory. That's because sshd changes the working directory to the user's home directory after the chroot.

So sshd tries to change to "/home/userabc/home/userabc", a directory which might not exist or have the wrong permissions on your machine. Maybe that's the cause of your issue.

OK, sftp should be able to "ls" the chroot directory, the one where sshd will change to when $HOME is not found under the chroot path nevertheless ...

Anyway, better create a directory /home/userabc/userabc with the low-level "userabc" directory being owned and writeable by userabc, then change the home directory in /etc/passwd to "/userabc" and change the chroot directory in sshd_config from "%h" to "/home/%u".

Alternatively, create a root-owned, only-root-writeable directory /home/sftpusers, make this the chroot directory and create user-owned directories corresponding to your usernames below it. The users' home directories should then become "/username".
0
 
LVL 7

Assisted Solution

by:Stampel
Stampel earned 500 total points
ID: 40386881
Thats right. Just be warned if it does not work be aware that it is not working on slightly old versions of OpenSSH
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Setting up Secure Ubuntu server on VMware 1.      Insert the Ubuntu Server distribution CD or attach the ISO of the CD which is in the “Datastore”. Note that it is important to install the x64 edition on servers, not the X86 editions. 2.      Power on th…
Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Suggested Courses
Course of the Month9 days, 23 hours left to enroll

571 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question