Quantcast
Channel: LowEndTalk
Viewing all articles
Browse latest Browse all 60127

Need some help chrooting SFTP-only user access

$
0
0

I need to give access to a folder to a user who needs to work with Wordpress sites over SFTP.

What I would like to do is to make sure that:

  1. He cannot run SSH, just SFTP

  2. He cannot see anything from the filesystem other than /home/userdir

From what I read this is exactly chrooting, however I have a few problems setting it up. I am on Debian 6 with Dropbear as SSH daemon.

A few questions:

\1. Originally my sftp subsystem was set up like this in /etc/ssh/sshd_config:

Subsystem sftp /usr/lib/openssh/sftp-server -u 0007

now in most tutorials it says that I have to change it to:

Subsystem sftp internal-sftp

Is this correct? Doesn't internal-sftp mean dropbear in my case? Should I change to openssh for chrooted SFTP accounts?

\2. Some tutorials ask to disable the user's shell with usermod -s /bin/false someuser. However when I do this, it disables SFTP as well. Is this normal?

\3. Finally tutorials usually note the following lines in the sshd_conf for the actual chrooting, or something similar:

Match group sftponly
         ChrootDirectory /home/%u
         X11Forwarding no
         AllowTcpForwarding no
         ForceCommand internal-sftp

However this had no effect for me. Is this because I'm using Dropbear?

Can someone tell me which are the proper steps to restrict to SFTP-only + home directory only access on Debian 6?


Viewing all articles
Browse latest Browse all 60127

Trending Articles