Allow User To Access Other User's Home Directory

Question

I have a Fedora server. I would create an SFTP user account which is allowed to access other user's home dir. Is it possible? For example

user1 -> /home/user1
user2 -> /home/user1

user2 can access the system in SFTP. I create the user2 with group generic-group and chrooted it:

(in my /etc/ssh/sshd_config)

AllowUsers user1 user2
Match Group generic-group
  ChrootDirectory %h
  ForceCommand internal-sftp
  AllowTcpForwarding no
  AllowAgentForwarding no
  X11Forwarding no

When I try to access in SFTP the system as user2, in the /var/log/secure:

Jan 31 11:46:24 perseo sshd[30073]: fatal: bad ownership or modes for chroot directory component "/home/user1/"

I also tried this different rule:

Match Group sftpusers
        ChrootDirectory /sftp/%u
        ForceCommand internal-sftp

and

mount --bind /sftp/user2/ /home/user1

with no success.

Answer 1

You give user1 and user2 one directory to share on the remote server ? with group write permission.

chroot is used to set up a restrictive environment (a mini root file system) then within there a /home/shared_directory could sit.

The first error is because you set the chrootdirectory to the users home directory (everything in chroot should be owned by root and not writable).

The second error you are setting the chroot to /sftp/username

Here's a similar question.

Chroot SFTP users who require access to multiple directories under same parent folder

Answer 2

You don't say this directly in your question, but I get the sense you're attempting to setup a common home directory for multiple users for SFTP purposes. I have a corporate SFTP server that I setup some time ago so I'll share with you how I approached the problem.

User account setup

For users that had a shared home directory I setup their accounts like so:

$ useradd -n -M -s $shell -g $group -d "/home/$homedir" "$uname"

Where:

• $shell was equal to /sbin/nologin
• $group was set to this group: sftponly
• $homedir was the name of the common home dir
• $uname is this particular user's username.

Home directory setup

I then setup the home directories like so:

$ mkdir -m 555 -p "/sftpdata/$homedir"
$ cp -pr /usr/local/bin/skel/. "/sftpdata/$homedir/."

NOTE: Since these weren't fully capable logins, I maintained a separate skeleton directory with basic dot files that these users' accounts needed.

At this point you could relax the home dir. permissions above to 775 if you wanted to allow the users to write data into their home directory. I set it up so that the user's had a upload & download directory, but I used the automounter, autofs since their home directories were actually mounted from our NAS.

/etc/auto.master

/home         /etc/auto.cifs_sftp    --timeout=2    --ghost

/etc/auto.cifs_sftp

*   /         -fstype=cifs,ro,noperm,netbiosname=${HOST},file_mode=0444,dir_mode=0555,credentials=/etc/sftpuser_credentials.txt ://NASServer/sftpdata/& \
    /upload   -fstype=cifs,rw,noperm,netbiosname=${HOST},file_mode=0666,dir_mode=0777,credentials=/etc/sftpuser_credentials.txt ://NASServer/sftpdata/&/upload

Structuring it this way autofs was stopping the users from writing into the download directory, but allowing them access to write to the upload directory. The credentials file (has to be permissions -rw-------.) would have an account that is allowed access to access the shares on the NAS. They're usually of the form:

username=dom\user
password=somethingreallylong

SSH configuration

The last bit of technology we need to employ is some modifications to SSH so that when user's SFTP into their account they're chrooted.

/etc/ssh/sshd_config

Subsystem   sftp    internal-sftp -f AUTH -l INFO

AllowGroups sftponly

Match   Group sftponly
    ChrootDirectory %h
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no
    PasswordAuthentication yes

Then just make sure to restart the SSH daemon.

$ service sshd restart

Answer 3

If you chroot user2 and have it controlled inside the box, why don't you uid user2 as user1?

Edit your /etc/passwd and copy uid of user1 to user2.

Depending on what you want that could be a solution.