I just installed a CentOS-based to serve as an SFTP server.
I need all incoming files to go /mnt/inbound/ folder, so I want to ensure that every user from this host that logs in via SFTP gets /mnt/inbound/ as their starting point, and I want to ensure that they cannot go anywhere else.
I got as far as being able to connect with a test user using an SFTP client and ensuring the user is jailed to their respective folder -- but user cannot upload files...
Here is what I have done so far:
- Create a group called sftponly for to contain all customer inbound users:
$ groupadd sftponly
- Modify /etc/ssh/sshd_config to use the internal-sftp Subsystem:
# Enable built-in implementation of SFTP Subsystem sftp internal-sftp
- Add the following at the end of sshd_conf:
Match Group sftponly # Force the connection to use the built-in SFTP support ForceCommand internal-sftp # Chroot the connection into the specified directory ChrootDirectory /mnt/inbound/%u # Disable network tunneling PermitTunnel no # Disable authentication agent forwarding AllowAgentForwarding no # Disable TCP connection forwarding AllowTcpForwarding no # Disable X11 remote desktop forwarding X11Forwarding no
- Adding a user to use sftp:
$ sudo useradd -g sftponly testuser
- must create the user folder under /mnt/inbound:
$ sudo mkdir /mnt/inbound/testuser
I can now use FileZilla (or any other client) to do an SFTP connection to this host, and I can see that the user is jailed to the /mnt/inbound/testuser folder. However the user cannot upload files.
I have tried changing the rights of the /mnt/inbound/test folder so that the user test can get access to it, but that breaks the user's ability to connect via SFTP.
I cannot change the owner of the folder to other than root, so how can I ensure that the user can read and write into their respective folder?
I have seen several attempts to answer similar questions around the internet (including StackExchange) but all seem to be missing a point or two -- since I always end up with a Broken SFTP setup when I try to follow the instructions provided in the answers.
Regards, P.