I have been working on this for 2 days now and am about to give up so someone please help.
I have a Red Hat 6 server joined to my active directory domain. Logins work just fine under normal circumstances. I have SSH login restricted to specific active directory groups by using require_membership_of= in the file/etc/security/pam_winbind.conf. It works great.
Now I need to lock those users to only have access to their home directory (chroot) and only allow sftp logins.
I have tried about a billion combinations of editing the /etc/ssh/sshd_config file but either end up with the user not being restricted to their home folder or them not being able to log in. The below configuration works just fine when I use local users/groups to restrict chroot and sftp login. (obviously I change the
Match group to the local user group)
The problem I think I have is the fact that LDAP users are not local users and they don't have local groups. Here is the relevant section of my sshd_config file
Match group 'Domain Users' ChrootDirectory %h X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp
When I restart sshd this give an error
/etc/ssh/sshd_config line 135: Bad Match condition
When I change
'Domain Users' to
Domain\040Users I don't get the error but LDAP users are not restricted to their home directories (chroot isn't working). I also tried changing the
ChrootDirectory %h to a new /chroot folder as well as /home/%u but both did not work.
The possible solutions I have thought of are
- Change the default group LDAP users are a part of (I haven't found this anywhere and the settings is /etc/default/useradd don't apply)
- Change the
Match groupin the sshd_config file to something that DOES apply to domain users. I tried
Domain\040Users, and the SID from LDAP of the Domain users group. All of which did not work or gave errors when restarting sshd
- Upon first login have the system create a local user/group (but this may break password syncing to AD
- Something else I have missed completely.
Does anyone have experience with setting up chroot restrictions with LDAP logins? I am at a loss and don't think I can open any more tabs in my browser.