1

I'm following the SFTP chroot wiki on ArchWiki and finding a huge snag: I can't get my sftponly users authorized.

Output of tail -2 /etc/passwd (my 2 users):

chris:x:1001:1002::/home/jail:/usr/bin/nologin
rick:x:1002:1002::/home/jail:/usr/bin/nologin

Output of groups chris and groups rick:

sftponly

The directory:

$ ls -l /home
total 24
drwxr-xr-x 3 root  root   4096 Jan  9 16:12 jail/

$ ls -l /home/jail
total 4
drwxrwxr-x 3 rick sftponly 4096 Jan  9 16:12 dropbox/

note: the only reason the dropbox/ directory is owned by rick is because I was experimenting with changing ownership of files within the chroot jail directory because this was something I'd read about in my extensive googling. I would like the both chris and rick to be able to edit the same files. I will investigate facl permissions when I get to the point that I can even log them in.

The relevant section in /etc/ssh/sshd_config

Subsystem sftp /usr/lib/ssh/sftp-server

Match Group sftponly
  ChrootDirectory %h
  ForceCommand internal-sftp
  AllowTcpForwarding no
  X11Forwarding no
  PasswordAuthentication yes

From the log when I try to log in via sftp rick@localhost and enter the password:

Jan 09 16:44:17 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:23 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:28 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:29 dell-dropbox sshd[688]: Connection closed by authenticating user rick ::1 port 57410 [preauth]

note: They both have passwords set. I am typing in the password correctly. I can sftp in as myself without any problem.

What on earth am I missing?

  • I have the Subsystem line commented out and instead put the line: Subsystem sftp internal-sftp, that works for me. – RoVo Jan 10 at 13:29
  • @RoVo I saw that in a couple of google results. My understanding is the ForceCommand internal-sftp overrides it for those accounts, but perhaps it doesn't work? I will try what you suggest. I'm curious if there's a security issue with it though, and if not, why Arch doesn't suggest it on the Wiki. Thanks for the tip. – malan Jan 10 at 15:04
  • Nope, didn't work. :-( – malan Jan 10 at 15:21
0

WARNING: I am not a security expert. I cannot ensure that it is impossible to login via ssh using this method, but it seems from my testing that you cannot.

The key problem seems to have been /bin/nologin, which turns out to have been unnecessary to begin with.

When sshd is configured with the above settings, and your users are set to have their home directories set to the jail like that, there is no way for them to ssh in anyway. Every tutorial I find on chroot jails with ssh, as opposed to tutorials about chroot jails and sftp, discusses the necessity of setting up system folders, essentially creating a system-within-a-system. Without them it seems to be impossible to log in via ssh but not via sftp.

So, follow my directions above, but don't set the user's shell to /bin/nologin. So far as I can tell, that's for daemon users.

Also, it's very easy to configure all this with ssh-keys. Simply having a root-owned .ssh/authorized_keys file in the shared home directory does the trick.

The result with a ssh-keys:

~ » ssh chriss@localhost                                                                                                                                                   
Enter passphrase for key '/home/malan/.ssh/id_rsa':
This service allows sftp connections only.
Connection to localhost closed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.