You don't say this directly in your question, but I get the sense you're attempting to setup a common home directory for multiple users for SFTP purposes. I have a corporate SFTP server that I setup some time ago so I'll share with you how I approached the problem.
User account setup
For users that had a shared home directory I setup their accounts like so:
$ useradd -n -M -s $shell -g $group -d "/home/$homedir" "$uname"
Where:
$shell
was equal to /sbin/nologin
$group
was set to this group: sftponly
$homedir
was the name of the common home dir
$uname
is this particular user's username.
Home directory setup
I then setup the home directories like so:
$ mkdir -m 555 -p "/sftpdata/$homedir"
$ cp -pr /usr/local/bin/skel/. "/sftpdata/$homedir/."
NOTE: Since these weren't fully capable logins, I maintained a separate skeleton directory with basic dot files that these users' accounts needed.
At this point you could relax the home dir. permissions above to 775 if you wanted to allow the users to write data into their home directory. I set it up so that the user's had a upload & download directory, but I used the automounter, autofs
since their home directories were actually mounted from our NAS.
/etc/auto.master
/home /etc/auto.cifs_sftp --timeout=2 --ghost
/etc/auto.cifs_sftp
* / -fstype=cifs,ro,noperm,netbiosname=${HOST},file_mode=0444,dir_mode=0555,credentials=/etc/sftpuser_credentials.txt ://NASServer/sftpdata/& \
/upload -fstype=cifs,rw,noperm,netbiosname=${HOST},file_mode=0666,dir_mode=0777,credentials=/etc/sftpuser_credentials.txt ://NASServer/sftpdata/&/upload
Structuring it this way autofs
was stopping the users from writing into the download directory, but allowing them access to write to the upload directory. The credentials file (has to be permissions -rw-------.
) would have an account that is allowed access to access the shares on the NAS. They're usually of the form:
username=dom\user
password=somethingreallylong
SSH configuration
The last bit of technology we need to employ is some modifications to SSH so that when user's SFTP into their account they're chrooted.
/etc/ssh/sshd_config
Subsystem sftp internal-sftp -f AUTH -l INFO
AllowGroups sftponly
Match Group sftponly
ChrootDirectory %h
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding no
PasswordAuthentication yes
Then just make sure to restart the SSH daemon.
$ service sshd restart