SFTP Server Setup

Simpo20 · 01-02-2020, 09:34 AM

First time posting, And Relative newbie - We are trying to put together a (what I was hoping to be) simple SFTP server with a top level user and sub 'user root' users (see image)

Image of what we are trying to achieve

(cant post image due to being new, but basically describes a TOP LEVEL user, with USER 1, 2 3 etc.. account with thier own locked down home/roots)

We would love to have some kind of Web Gui to manage but not essential - attempting to build in any recommended linux distro.

We have had this working but the permissions side of things were being inconsistent at best.

Any Help - or directions on where to post appreciated.

Thanks Adrian

Turbocapitalist · 01-03-2020, 02:05 AM

Welcome.

Adding a GUI would only complicate things and just represent the text file anyway.

How many users are you thinking about adding?

What it sounds like you are aiming for is a set of SFTP-only accounts locked into a chroot. The chroot target must be root-owned and writable only by root. There are two ways to do that. One is to nest an extra directory within the users' chroots:

Code:

mkdir /toplevel/; 
chown root:root /toplevel/; 
chmod u=rwx,g=rwx,o=rx /toplevel/;

mkdir -p /toplevel/user/user/; 
chown root:root /toplevel/user/; 
chown user:user /toplevel/user/user/ ; 
chmod u=rwx,g=rwx,o=rx /toplevel/user/;  
chmod u=rwx,g=rwx,o=rx /toplevel/user/user/;

Then the matching stanza in sshd_config could be something like this:

Code:

Match Group sftp-only
        ChrootDirectory /toplevel/%u
        AllowTCPForwarding no
        X11Forwarding no
        ForceCommand internal-sftp -d %u

The %u substitutes the account's username in the path. See "man sshd_config" for the details.

Simpo20 · 01-03-2020, 03:09 AM

Hi Turbo,

Thanks for the reply, initially there would be approx 20-25 individual users with thier own 'home/root' directory.

Ill give that a go today - sounds so simple when someone puts it down on paper like that.

Kind Regards

Turbocapitalist · 01-03-2020, 03:12 AM

It's pretty easy, once you see how it fits together.

Note that I just tweaked the ChrooDirectory in the example to match the example better.