If you want all setup all the limiting stuff you mention I would suggest to use ProFTPd.
sftp_module you are able to only allow a secure session. See http://www.proftpd.org/docs/contrib/mod_sftp.html for details about the
sftp functionality. Near the bottom of the page an example configuration is listed.
DefaultRoot directive you can isolate the granted user into his/her own directory
<LIMIT> structure you are able to limit the FTP commands you want to allow, i.e.
READ so the user can not retrieve files. See http://www.proftpd.org/docs/howto/Limit.html for details.
When you setup the
sftp configuration in ProFTPd you probably want to have it to listen on another port than
ssh, for example 2222. Configure your firewall and/or router to allow traffic coming from
stranger to the port you choose for ProFTPd. Another possibility is to run ProFTPd's
sftp module on port 22 and reconfigure
ssh to listen on another port.
A sample configuration can look like:
# The SFTP configuration
# Configure the RSA, DSA, and ECDSA host keys, using the same host key
# files that OpenSSH uses.
DefaultRoot ~ users,!staff
Note: This is not a complete configuration of ProFTPd, you should review and modify the ProFTPd default configuration to have it fits your need.
There is another possibility to just use OpenSSH for this:
Create the user
stranger and set a password for the user:
useradd -m -d /home/stranger -s /bin/true stranger
Edit the file
/etc/ssh/sshd_config and check if the following line exists, add it if it does not exists:
Subsystem sftp internal-sftp
Next add a Match block at the bottom of
Match User stranger
ForceCommand internal-sftp -P read,remove
Note: the user will be able to overwrite an existing file.
Set the owner of the directory
chown root:stranger /home/stranger
root must be the owner and may be the only one to have write permission if ChrootDirectory is used. An alternative might be to add
-d %u to the
ForceCommand internal-sftp line and set
ChrootDirectory /home but a user will be able to
cd / and see other usernames with
Create an upload directory for the user:
mkdir /home/stranger/upload; chown stranger:stranger /home/stranger/upload
Now you can logon as user
When you upload a file it should be ok:
sftp> put myfile
Uploading myfile to /upload/myfile
myfile 100% 17 0.0KB/s 00:00
sftp> get myfile
Fetching /upload/myfile to myfile
/upload/myfile 0% 0 0.0KB/s --:-- ETA
Couldn't read from remote file "/upload/myfile" : Permission denied