The following article shows how to allow access to some users of the system SFTP using SSH to transfer files securely to prevent access to directories outside your home (Chroot). In addition, users can not connect to the system via SSH from the command line.
Why use SFTP with SSH instead of using the vsftpd service?
Because all information is encrypted (including the password) and prevents someone from accessing the information during the transfer.
Squeeze In Debian, the default configuration of SSH allows access to all users of the system and go through the directory tree including /. However, you can restrict certain users access to the server and cage them in your own home (the user can connect to the server but can not go outside your home directory). Preparing
system first creates a directory that contains the user's home group:
After establishing a user group and the intended users:
With the above command created the group "usersjaula" and user "username" no shell belonging to the newly created group.
then change the permissions of the following directories:
With previous commands the user can not write in their own home. Thus is created a directory in your home so you can store your files.
permits were modified in the previous steps were made to run the caged SFTP. The owner of the cage directory and directories on this, you must be root with permissions 755. This is a restriction of ChrootDirectory in OpenSSH.
SSH Settings
The SSH configuration file is / etc / ssh / sshd_config . So all the settings are made in this file.
for safety is recommended to disable root access via SSH with the following directive:
not limit access to SSH service to certain users AllowUsers directive is used:
To limit access to certain groups may be used:
Verify that you have the following line to cage the SFTP service:
Add the following lines to end of / etc / ssh / sshd_config for cage to a user: username User
Match
Add the following lines to end of / etc / ssh / sshd_config to cage a group of users:
For changes to take effect restart the service:
If you have a firewall you must open the port. Remotely access
For SFTP remote access service can use the file browser by typing in the address bar "sftp: / / IP".
From Windows you can use any client that is shown in this list . Of those who are on the list, I recommend FileZilla because with this File upload with Ñ and accents are displayed correctly in GNU / Linux.
If you try to access from SSH command line to mark the error: This service
SOURCE:
http://www.esdebian.org/wiki/enjaulado-sftp
http://linuxsix.blogspot.com/2009/03/tutorial-para-hacer-una-jaula- chroot.html
http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config
Why use SFTP with SSH instead of using the vsftpd service?
Because all information is encrypted (including the password) and prevents someone from accessing the information during the transfer.
Squeeze In Debian, the default configuration of SSH allows access to all users of the system and go through the directory tree including /. However, you can restrict certain users access to the server and cage them in your own home (the user can connect to the server but can not go outside your home directory). Preparing
system first creates a directory that contains the user's home group:
# mkdir / home / usersjaula
After establishing a user group and the intended users:
# groupadd usersjaula
usersjaula # useradd-g-d / home / usersjaula / username-m-s / bin / false username # passwd username
With the above command created the group "usersjaula" and user "username" no shell belonging to the newly created group.
then change the permissions of the following directories:
# chmod 755-R / home / usersjaula
# chmod 755-R / home / usersjaula / username root.root
# chown-R / home / usersjaula
With previous commands the user can not write in their own home. Thus is created a directory in your home so you can store your files.
# mkdir / home / usersjaula / username / files nombreUsuario.nombreUsuario
# chown-R / home / usersjaula / username / files
permits were modified in the previous steps were made to run the caged SFTP. The owner of the cage directory and directories on this, you must be root with permissions 755. This is a restriction of ChrootDirectory in OpenSSH.
SSH Settings
The SSH configuration file is / etc / ssh / sshd_config . So all the settings are made in this file.
for safety is recommended to disable root access via SSH with the following directive:
PermitRootLogin
not limit access to SSH service to certain users AllowUsers directive is used:
AllowUsers usernamenombreUsuario2 etc.
To limit access to certain groups may be used:
AllowGroups usersjaula
Verify that you have the following line to cage the SFTP service:
Subsystem sftp / usr / lib / openssh / sftp-server
Add the following lines to end of / etc / ssh / sshd_config for cage to a user: username User
Match
ChrootDirectory / home / usersjaula / username
ForceCommand / usr / lib / openssh / sftp-server # AllowTcpForwarding
not optional
# # # # # optional X11Forwarding not
Add the following lines to end of / etc / ssh / sshd_config to cage a group of users:
usuariossftp group
ChrootDirectory Match / Home / usersjaula
ForceCommand / usr / lib / openssh / sftp-server # AllowTcpForwarding
optional
no # # # # # optional X11Forwarding not
For changes to take effect restart the service:
# / etc / init .d / ssh restart
If you have a firewall you must open the port. Remotely access
For SFTP remote access service can use the file browser by typing in the address bar "sftp: / / IP".
From Windows you can use any client that is shown in this list . Of those who are on the list, I recommend FileZilla because with this File upload with Ñ and accents are displayed correctly in GNU / Linux.
If you try to access from SSH command line to mark the error: This service
sftp Allows connections only.
SOURCE:
http://www.esdebian.org/wiki/enjaulado-sftp
http://linuxsix.blogspot.com/2009/03/tutorial-para-hacer-una-jaula- chroot.html
http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config
