Calories In A Bag Of Popped Orville Popcorn

Caging some SFTP users

The following article shows how to allow access to some users of the system SFTP using SSH to transfer files securely to prevent access to directories outside your home (Chroot). In addition, users can not connect to the system via SSH from the command line.

Why use SFTP with SSH instead of using the vsftpd service?
Because all information is encrypted (including the password) and prevents someone from accessing the information during the transfer.

Squeeze In Debian, the default configuration of SSH allows access to all users of the system and go through the directory tree including /. However, you can restrict certain users access to the server and cage them in your own home (the user can connect to the server but can not go outside your home directory). Preparing



system first creates a directory that contains the user's home group:

 # mkdir / home / usersjaula 

After establishing a user group and the intended users:

 # groupadd usersjaula 
 usersjaula # useradd-g-d / home / usersjaula / username-m-s / bin / false username # passwd username 
 

With the above command created the group "usersjaula" and user "username" no shell belonging to the newly created group.

then change the permissions of the following directories:

 # chmod 755-R / home / usersjaula 
 # chmod 755-R / home / usersjaula / username root.root 
 # chown-R / home / usersjaula 

With previous commands the user can not write in their own home. Thus is created a directory in your home so you can store your files.

 # mkdir / home / usersjaula / username / files nombreUsuario.nombreUsuario 
 # chown-R / home / usersjaula / username / files 

permits were modified in the previous steps were made to run the caged SFTP. The owner of the cage directory and directories on this, you must be root with permissions 755. This is a restriction of ChrootDirectory in OpenSSH.

SSH Settings

The SSH configuration file is / etc / ssh / sshd_config . So all the settings are made in this file.

for safety is recommended to disable root access via SSH with the following directive:

 PermitRootLogin 

not limit access to SSH service to certain users AllowUsers directive is used:

 AllowUsers username 

nombreUsuario2 etc.
To limit access to certain groups may be used:

 AllowGroups usersjaula 

Verify that you have the following line to cage the SFTP service:

 Subsystem sftp / usr / lib / openssh / sftp-server 

Add the following lines to end of / etc / ssh / sshd_config for cage to a user: username User
Match

 
 ChrootDirectory / home / usersjaula / username 
 ForceCommand / usr / lib / openssh / sftp-server # AllowTcpForwarding 
 not optional 
 # # # # # optional X11Forwarding not 

Add the following lines to end of / etc / ssh / sshd_config to cage a group of users:

 usuariossftp group 
 ChrootDirectory Match / Home / usersjaula 
 ForceCommand / usr / lib / openssh / sftp-server # AllowTcpForwarding 
 optional 
 no # # # # # optional X11Forwarding not 

For changes to take effect restart the service:

 # / etc / init .d / ssh restart 

If you have a firewall you must open the port. Remotely access



For SFTP remote access service can use the file browser by typing in the address bar "sftp: / / IP".

From Windows you can use any client that is shown in this list . Of those who are on the list, I recommend FileZilla because with this File upload with Ñ and accents are displayed correctly in GNU / Linux.

If you try to access from SSH command line to mark the error: This service

 sftp Allows connections only. 

SOURCE:
http://www.esdebian.org/wiki/enjaulado-sftp
http://linuxsix.blogspot.com/2009/03/tutorial-para-hacer-una-jaula- chroot.html
http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config