LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 05-22-2013, 10:05 AM   #1
Yamabob217
LQ Newbie
 
Registered: May 2004
Posts: 6

Rep: Reputation: 0
ls command closes sftp connection


I have SFTP setup and everything seems to be working fine with the exception of listing directories on the remote server using the ls command, which drops the connection. Has anyone experienced the same and solved the problem or has a suggestion on what might be causing this issue?

Relevant coden in the sshd_config file:
# override default of no subsystems
#Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp
Match Group sftpgroup
ChrootDirectory /sftp/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
 
Old 05-22-2013, 10:14 AM   #2
linosaurusroot
Member
 
Registered: Oct 2012
Distribution: OpenSuSE,RHEL,Fedora,OpenBSD
Posts: 982
Blog Entries: 2

Rep: Reputation: 244Reputation: 244Reputation: 244
Is there any chance there's a funny filename in the listing that includes control characters that interfere with something? Does it affect every directory?

Last edited by linosaurusroot; 05-22-2013 at 10:16 AM.
 
Old 05-22-2013, 10:30 AM   #3
Yamabob217
LQ Newbie
 
Registered: May 2004
Posts: 6

Original Poster
Rep: Reputation: 0
linosaurusroot, It seems to be occurring in all directories. I have one user defined: mysftpuser. I have the root directory chrooted to /sftp/%u and a directory of /sftp/mysftpuser that is chowned to root:sftpgroup. I also have a sub-directory defined as /sftp/mysftpuser/upload.

/sftp
-| mysftpuser
-|-| upload

Both directories are empty at the moment. I can cd (change directory) from mysftpuser and upload and vice-versa fine. But ls drops the connection when entered from either directory.
 
Old 05-24-2013, 02:42 AM   #4
bloodstreetboy
Member
 
Registered: May 2012
Posts: 201
Blog Entries: 3

Rep: Reputation: 37
Have you tried
Quote:
$ ls -l
Does it still leave connection?

Are you executing a shell script and trying to change directory in the script?
because it might be listing of the files of your system instead of the logged in system.
 
Old 05-24-2013, 08:16 AM   #5
Yamabob217
LQ Newbie
 
Registered: May 2004
Posts: 6

Original Poster
Rep: Reputation: 0
From what I can see, the problem that I'm having is related to locking down user access to the file system via chroot. I was able to get the ls command to work by removing the "ChrootDirectory" line in the sshd_config file. Does anyone know if there's further configuration that needs to be done when configuring chroot for SFTP? I am using RHEL 6. Thanks.
 
Old 05-24-2013, 08:33 AM   #6
linosaurusroot
Member
 
Registered: Oct 2012
Distribution: OpenSuSE,RHEL,Fedora,OpenBSD
Posts: 982
Blog Entries: 2

Rep: Reputation: 244Reputation: 244Reputation: 244
Do you have a statically linked /bin/ls under the new root?
 
Old 05-24-2013, 09:15 AM   #7
fortran
Member
 
Registered: Nov 2011
Location: Cairo, Egypt
Distribution: CentOS, RHEL, Fedora
Posts: 300
Blog Entries: 2

Rep: Reputation: 51
Quote:
Originally Posted by Yamabob217 View Post
Does anyone know if there's further configuration that needs to be done when configuring chroot for SFTP?
You need to read this
http://www.thegeekstuff.com/2012/03/chroot-sftp-setup/
 
Old 05-24-2013, 09:23 AM   #8
bloodstreetboy
Member
 
Registered: May 2012
Posts: 201
Blog Entries: 3

Rep: Reputation: 37
Please follow the steps

1) Define a group of which members will be chrooted:

This is a standard Linux group assignment. The group name is user definable.
Define a group: groupadd sftpusers

Groups are defined in the file /etc/group
Quote:
sftpusers:x:1002:
2) Add users to the group and deny users shell access:

A non-working shell can be assigned to a user to prevent shell access. Linux includes two shells for this purpose:
/sbin/nologin
/bin/false
User accounts can be modified after creation: usermod -s /bin/false -g sftpusers
The shell can be assigned to a user upon user account creation: useradd -s /bin/false -G sftpusers userid

The user group and shell assignment can be edited in the file /etc/passwd:
From: user1:x:1000:1000:George,,,:/home/user1:/bin/bash
To: user1:x:1000:1002:George,,,:/home/user1:/bin/false

3) Create user home directories:

The typical user home directory is /home/userid
The use of chroot requires a new root which is not "/". In this configuration we will use /home/sftpusers. All user home directories will have their true physical paths added to the rooted path at /home/sftpusers. Thus the true physical paths will be /home/sftpusers/home/userid but will appear to the user to be at /home/userid
The user "root" must own the rooted directory: chown root.root /home/sftpusers

The user "root" should own the rooted home directory: chown root.root /home/sftpusers/home

The user will own their home path: chown userid.sftpusers -R /home/sftpusers/home/userid

Set appropriate permissions: chmod 755 /home/sftpusers/home/userid/

Tip: Set SELinux rules on home directory: setsebool -P ssh_chroot_rw_homedirs on

4) SSH daemon configuration to chroot a user group:

Edit the sshd configuration file: /etc/ssh/sshd_config
(partial file shown)
Quote:
#UsePAM no
UsePAM yes
UsePrivilegeSeparation yes
StrictModes yes
PermitEmptyPasswords no
# change default
# Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp
Match Group sftpusers
ChrootDirectory /home/sftpusers
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
[Potential Pitfall]: You may get the following error:

[user1]$ sftp user1@sftp.megacorp.com
Connecting to 192.121.121.1...
user1@sftp.megacorp.com's password:
Write failed: Broken pipe
Couldn't read packet: Connection reset by peer
This is typically due to a miss-configuration: Note that sshd will reject sftp connections to accounts that are set to chroot into any directory that has ownership/permissions that sshd doesn't consider secure.
[Potential Pitfall]: You may get the following error:

sftp> put example.sql
Uploading example.sql to /home/user1/example.sql
Couldn't get handle: Permission denied
This is typically due to a directory permissions problem:
/home/sftpusers - owned by root. This will be chrooted.
/home/sftpusers/home - owned by root.
/home/sftpusers/home/user1 - owned by user
After sshd has chrooted to the ChrootDirectory, it will chdir to the home directory as normal.

Chrooting individual users:
Example sshd configuration file: /etc/ssh/sshd_config
(partial file shown)
Quote:
#UsePAM no
UsePAM yesUsePrivilegeSeparation yes
StrictModes yes
PermitEmptyPasswords no
Subsystem sftp internal-sftp
Match User userx
ChrootDirectory /home/sftpusers
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
 
Old 05-24-2013, 03:23 PM   #9
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 26,636

Rep: Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965
Quote:
Originally Posted by fortran View Post
Why? The OP clearly said they already HAD sftp set up and working...a second sftp setup guide doesn't address the OP's problem. There's nothing in that article/guide that addresses a non-working ls command.

OP, did you get your ls issue sorted out? You indicated that you had....
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] SFTP ls drops connection from cron, but not from command line gjbloom Red Hat 2 08-06-2012 09:41 AM
ssh connection forces password change, then closes connection loadedmind Linux - Newbie 2 02-16-2011 01:24 PM
Pam immediatly closes sftp session for jailed users, but not for scp Carroarmato0 Linux - Server 3 09-15-2009 08:21 AM
How do I use sftp to upload my web site? (no sftp tar command) johnMG Linux - Networking 6 06-21-2005 09:14 PM
ls command closes sftp connection SpecialK5106 Linux - Networking 4 11-03-2003 02:18 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 05:19 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration