Create sftp-only account

DD345 · 06-01-2021, 01:28 PM

I have setup VSFTPD as my ftp server. I would like to create a sftp-only account, I am not sure how this should be done in Slackware.

IsaacKuo · 06-01-2021, 04:20 PM

VSFTPD is for the ftp protocol, not sftp. If you want to use sftp (and it IS preferable to ftp if you're not sure you want ftp), then you need to set up ssh server.

bassmadrigal · 06-01-2021, 05:38 PM

Quote:

Originally Posted by DD345

I have setup VSFTPD as my ftp server. I would like to create a sftp-only account, I am not sure how this should be done in Slackware.

All that is needed for sftp is an ssh account. I'm pretty sure the ssh server is started by default on a new install. It also defaults to any user having ssh/sftp access.

So, most likely, all you need to do is connect to the computer using sftp by providing your user's username and password.

DD345 · 06-01-2021, 08:02 PM

Hi thanks,

I set the VSFTPD as my ftp server. I was able to connect using a local account, now I have an issue where it says protocol is not assigned despite me not making any modifications and also reconfiguring from scratch. I know this is a different issue, but is there anyway to check what the issue is or why this is the case?

DD345 · 06-01-2021, 08:07 PM

Quote:

Originally Posted by bassmadrigal

All that is needed for sftp is an ssh account. I'm pretty sure the ssh server is started by default on a new install. It also defaults to any user having ssh/sftp access.

So, most likely, all you need to do is connect to the computer using sftp by providing your user's username and password.

I was able to connect using a local account, but I would like this user not to be able to log in via ssh.

DD345 · 06-01-2021, 08:12 PM

Quote:

Originally Posted by IsaacKuo

VSFTPD is for the ftp protocol, not sftp. If you want to use sftp (and it IS preferable to ftp if you're not sure you want ftp), then you need to set up ssh server.

I did not know this, thank you. Would something like Dropbear SSH/OpenSSH work?

marav · 06-01-2021, 08:51 PM

Quote:

Originally Posted by DD345

I was able to connect using a local account, but I would like this user not to be able to log in via ssh.

You can add the option DenyUsers to your /etc/ssh/sshd_config

Code:

DenyUsers
This keyword can be followed by a list of user name patterns, separated by spaces.
Login is disallowed for user names that match one of the patterns

Turbocapitalist · 06-01-2021, 09:10 PM

Quote:

Originally Posted by DD345

Would something like Dropbear SSH/OpenSSH work?

Yes, but OpenSSH would give the most functionality. Please remove vsftpd while you are in there.

Then for SFTP-only accounts with OpenSSH, assign a new system group and put the accounts which should be restricted into it. Then use a Match directive in sshd_config to set up the SFTP-only access. One way would be like this:

Code:

Subsystem sftp internal-sftp

Match Group limited
	ForceCommand internal-sftp
        AllowStreamLocalForwarding no
	AllowTCPForwarding no
	X11Forwarding no

There, any accounts in the group 'limited' will only be able to use SFTP and be set to use the built-in SFTP server. See "man sshd_config" for more details on those settings.

Newer versions of OpenSSH can have a simpler configuration:

Code:

Subsystem sftp internal-sftp

Match Group limited
	ForceCommand internal-sftp
        DisableForwarding yes

Thom1b · 06-01-2021, 09:37 PM

Hi, I needed to have a sftp-only account on a different sshd port. I choose to use proftpd, it works very well.

marav · 06-01-2021, 09:50 PM

Quote:

Originally Posted by Thom1b

Hi, I needed to have a sftp-only account on a different sshd port. I choose to use proftpd, it works very well.

you can also create a user with /sbin/nologin instead of /bin/bash as login shell
and ChrootDirectory in sshd_config

Code:

Match User sftp_only_user
   ChrootDirectory /some_sftp_directory
   ForceCommand internal-sftp

DD345 · 06-01-2021, 11:45 PM

Thank you for the help, I am now trying to ssh for playing around/testing purposes. When I attempt to do so it says "port 22: Protocol not available".

What exactly does this mean and how can I resolve this?

marav · 06-02-2021, 02:18 AM

Quote:

Originally Posted by DD345

Thank you for the help, I am now trying to ssh for playing around/testing purposes. When I attempt to do so it says "port 22: Protocol not available".

What exactly does this mean and how can I resolve this?

you can try with : ssh -v user@host
to debug

fskmh · 06-02-2021, 05:51 AM

Quote:

Originally Posted by DD345

I have setup VSFTPD as my ftp server. I would like to create a sftp-only account, I am not sure how this should be done in Slackware.

It looks like the OP is close to a solution but here's my suggestion anyway. I use rssh (restricted shell) on a lab gateway machine that I deploy Clonezilla images from. I've firewalled out non-local subnets but to prevent users in the lab from ssh-ing as the Clonezilla user I installed rssh and set the login shell to /usr/bin/rssh.

https://slackbuilds.org/repository/14.2/network/rssh/

rssh appears to be unmaintained so I would not open it to the interwebs unless you have fail2ban and/or a robust firewall config.