How do you enable chrooted SFTP access to a file in RHEL 6.5?

Question

I am attempting to set up chrooted SFTP access to a RHEL 6.5 server. I have gone through the standard steps of editing the sshd_config file to match any users in the group an chroot them like so:

Match group prisoners
    ChrootDirectory /home/%u
    AllowTCPForwarding no
    X11Forwarding no
    ForceCommand internal-sftp

as well as to set

Subsystem sftp internal-sftp

The user 'test' has a directory as follows:

[root@ip-10-0-1-158 ~]# ls -l /home/test
total 4
drwxrwxr-x. 3 root prisoners 4096 Jul 20 17:55 SFTP

(I have also recursively set both ownership and access permissions on this directory)

and is in the proper group:

[root@ip-10-0-1-158 ~]# sudo -u test id
uid=501(test) gid=498(prisoners) groups=498(prisoners) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

When I try to edit or create files in the /home/test/SFTP directory as the test user via my ssh session, everything works as intended. If I log in via WinSCP, I authenticate properly and can see the contents of the /home/test directory (but not modify them). However, it does not allow me to view, edit, or create files in the /home/test/SFTP directory.

WinSCP error message:

Error listing directory '/SFTP'.
Permission denied.
Error code: 3
Error message from server: Permission denied

Any help would be greatly appreciated.

Note: I have successfully set up a similar sftp chrooted access on RHEL 7 and am struggling to understand why the user permissions seem to not be working via SFTP.

Answer 1

Note: I have successfully set up a similar sftp chrooted access on RHEL 7 and am struggling to understand why the user permissions seem to not be working via SFTP.

Probably SELinux labels went wrong. Check if they are correct and try to fix them using

# restorecon -RF /

Answer 2

The way I have it set up (to teach a programming class) on a Debian system is:

First, create the user. Here's the script I use, it adds the user, creates the home directory, puts them in a a prisoner type group, copies in some default files, sets permissions and ownerships, creates sql databases, etc. Overkill for you, you can use just the first few lines.

#!/bin/bash

# $1 is username to create
# call as   root@darkstar:~/ # ./script.sh username

# add the user and put them in the jailusers group, set their home 
# directory so it is at http://www.example.com/username 
# and set their shell to /bin/false so they can't ssh in
useradd -g jailusers -d /var/jailweb/www-example.com/$1 -s /bin/false $1
mkdir -p /var/jailweb/www-example.com/$1

# i copy some template files in for them - this is a programming class
cp /root/jailtemplate-filez/*php /var/jailweb/www-example.com/$1

# fix the ownership of them - the /var/jailweb/www-example.com has been
# chmodded as g+s so the webserver will be able to read all the files
# note that this is NOT the ideal way to deal with this, but was needed
# for my purposes
chown  $1.www-data /var/jailweb/www-example.com/$1
chown  $1.www-data /var/jailweb/www-example.com/$1/index.php
chmod -R 750 /var/jailweb/www-example.com/$1

# put their name on their front page
sed -i s/STUDENT/$1/g /var/jailweb/www-example.com/$1/index.php

# generate a "random" password for sftp login
salt="oh god there has to be a better way!"
lpass=`echo $1 $salt | md5sum | cut -c 5-15`

# generate a "different" "random" password
# for them to use for mysql access
mpass=`echo $1 $salt | md5sum | cut -c 13-22`
# and set it for the userlogin programmatically
echo $1:$lpass | chpasswd

# create a sql scritp file to create their mysql accounts and
# create a database for them, grant rights, etc
cat webusers-mysql_template | sed s/USERNAME/$1/g | sed s/PASS/$mpass/g >> webusersusers.sql

# put their mysql info into a php file in their web directory
cat dbinfo.php-template | sed s/USERNAME/$1/g | sed s/PASSWORD/$mpass/g > /var/jailweb/www-example.com/$1/dbinfo.php
# make sure the webserver can read it... this all SHOULD be setup for suexec
# and having each user in their own primary group... then the sticky bit, etc
# wouldn't be needed, but I'm lazy
chown $1.www-data /var/jailweb/www-example.com/$1/dbinfo.php
chmod 440 /var/jailweb/www-example.com/$1/*.php

# if there needs to be a directory the webserver can
# write to, uncomment these
#mkdir -p /var/jailweb/www-example.com/$1/writeable
#chown $1.www-data /var/jailweb/www-example.com/$1/writeable
#chmod 770 /var/jailweb/www-example.com/$1/writeable

Next, in /etc/ssh/sshd_config be sure to uncomment the default sftp provider and add in the internal-subsystem one:

#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

Finally also in /etc/ssh/sshd_config add your group matching. I set a slightly different default umask on mine -

Match Group jailusers
        ChrootDirectory /var/jailweb
        ForceCommand internal-sftp -u 0027

Note that I'm pointing the / of the chroot to the directory that contains their home directory.

Restart the ssh daemon and you should be good to go. Your users should be able to add/edit/delete stuff in their /username directory. If you want to add a shared directory, you'll need to create it and change the ownership on it