I lose SSH access when setting up SFTP

Damnedkrt · 07-29-2013, 03:33 AM

Hi!

I've been fooling around with SFTP. I can get it up and running, but whenever I do so, I can't nog longer log in with SSH with my user.
SFTP is set up for another user that should have SFTP access only.

Basicly, I just wanna share a few files with a friend - but not letting this friend be able to access anything else on my server.

I've read the thousand different SFTP-guides that are out there, so I'm guessing I'm making a pretty easy configuration error.

This is my sshd_config:

Code:

# -- Chrooted sftp server options
#Subsystem sftp internal-sftp
#Match Group sftpusers sftpuser
#ChrootDirectory /home/%u
#ForceCommand internal-sftp
#AllowTcpForwarding No
#X11Forwarding no

#AllowGroups sftpusers sftpuser myuser

Could someone please tell what is shutting my user out?

tombelcher7 · 07-29-2013, 07:14 AM

As SFTP runs as a subsystem of SSH it runs on whatever port the SSH daemon is listening on and that is administrator configurable.

http://serverfault.com/questions/741...-does-sftp-use

It sounds like it shouldn't interfere but it does.

What do you get if you telnet port 22 on this host? Does it tell you what service is listening on it?

Damnedkrt · 07-29-2013, 07:53 AM

Quote:

Originally Posted by tombelcher7

As SFTP runs as a subsystem of SSH it runs on whatever port the SSH daemon is listening on and that is administrator configurable.

http://serverfault.com/questions/741...-does-sftp-use

It sounds like it shouldn't interfere but it does.

What do you get if you telnet port 22 on this host? Does it tell you what service is listening on it?

I could try telnet, but I'd rather not, since this is a headless machine it is a pain to undo those changes.

I have ssh on port 2225 - which is the port I connect with SFTP with as well.

Habitual · 07-29-2013, 11:05 AM

I used this:

Code:

Match User <user>         
        ChrootDirectory /home/<user>
        ForceCommand internal-sftp
        AllowTcpForwarding no

match Group seemed to not work as intended.

See - josircg's answer

tombelcher7 · 07-30-2013, 06:47 AM

Hello,

I think my suggestion was misunderstood; what I meant was to use a telnet client from a separate host to query the port on your server machine;(typically it gives you information regarding the service that is listening on the port).

Otherwise use NMAP from another host failing this.

Quote:

Originally Posted by Damnedkrt

I could try telnet, but I'd rather not, since this is a headless machine it is a pain to undo those changes.

I have ssh on port 2225 - which is the port I connect with SFTP with as well.

Damnedkrt · 07-30-2013, 07:00 AM

Quote:

Originally Posted by tombelcher7

Hello,

I think my suggestion was misunderstood; what I meant was to use a telnet client from a separate host to query the port on your server machine;(typically it gives you information regarding the service that is listening on the port).

Otherwise use NMAP from another host failing this.

What I meant was, when I uncomment those lines in my sshd_config - I lose SSH. And the server is a headless one - so I have to connect keyboard and monitor in order to undo the changes in sshd_config... I'm not really a fan of physical excercise

I'm familiar with NMAP, I'll give it a try and get back with the result.
But then I guess telnet isn't the most advanced application in the world either

I've just never bothered to learn it.