I need a specialized configuration for our companys sftp server to be able to exchange files with our customers in a secure way (The server runs Debian Linux 8.7).
- We need a "customers" folder where all our support personel (each one with a separate user account) have read/write access.
- Under the "customers" folder we need a subfolder for each one of our customers.
- Every customer also has its own user account on the server.
- The "support users" should be chrooted on the "customers"-folder.
- Each "customer user" should be chrooted in his own directory.
- The authentication method should be via passphrase protected certificate (not via password)
- Neither the support users nor the customer users should be able to add, change or remove files and/or folders in the top folder (customers)
customers <--------- All support personel entry point | +--customer_001 <-------- Customer 1 entry point | | | +--files... | +--customer_002 <-------- Customer 2 entry point | | | +--files... | +--customer_003 <-------- Customer 3 entry point | | | +--files... . . .
I configured the sshd as follows:
[...] PasswordAuthentication yes [...] # Subsystem sftp /usr/lib/openssh/sftp-server Subsystem sftp internal-sftp [...] Match Group kunden ChrootDirectory %h ForceCommand internal-sftp Match Group wit-user ChrootDirectory /var/sftp/customers ForceCommand internal-sftp
- The "customer users" are configured in a way that their home directories are the corresponding directory under "customers".
- The "support users" are configured, that their home directory is the "customers"-folder (although I'm not sure, if that is important or even correct)
My problem is, that I'm not sure how to configure ownership and permissions on the folders and files. As far, as I understand it, the "internal-sftp" server needs root:root ownership in its (ch)root directory. Since the root directory is in both cases different:
How do I have to configure file/directory permissions?
How do I have to configure ownership on files and directories?
How should I handle the ~/.ssh folders for the different users when the home folder is the corresponding sftp chroot directory (if this is a correct solution at all)?
Do I need ACL's for this? If so: how do I have to configure it to meet the above mentioned requirements?
I tried this(german ubunutusers.de wiki entry about "sshd-configuration") but that only solves the part of the problem with the "customer users" not the "support users".