0

I modified /etc/ssh/sshd_config with these lines to support an sftp user group that isn't able to SSH.

    Subsystem sftp internal-sftp -l VERBOSE
    Match Group sftpusers
    X11Forwarding no
    AllowTcpForwarding no
    ChrootDirectory %h
    ForceCommand internal-sftp

I create a user in the sftpusers group, with ssh capabilities restricted like so:

useradd -g sftpusers -s /sbin/nologin <username>

The problem is, even if I use the following command to give recursive permissions to all users and groups in their home folder, when they create a new file, they immediately lose access because the default file permissions are not what I recursively set the file structure to:

chmod -R 777 /home/<username>/

I've tried giving the user ownership of the file structure, but that makes it so the user can no longer sftp (I believe because of the ChrootDirectory option, making it so their home directory and all sub components must be owned by root). I'd really like a solution that allows a user to only be able to sftp (no ssh) while having no access to the majority of files in their home directory, unless specifically given access or created by them.

Improve this question
8
  • Please update your question to include the command that creates a user who's only allowed to use SFTP.
    – Sotto Voce
    Jul 18, 2022 at 4:53
  • "so their home directory and all sub components must be owned by root" - not quite. Only the home directory (and its parents) must be owned by root. Subdirectories can be owned by the user
    – roaima
    Jul 18, 2022 at 8:03
  • "having no access to the majority of files in their home directory" don't put the files in the home directory. It's a chroot so there should be very little need to put anything there that doesn't need to be there
    – roaima
    Jul 18, 2022 at 8:18
  • @SottoVoce I do believe that is in the post. "useradd -g sftpusers -s /sbin/nologin <username>" is the command I use to create the user.
    – user534166
    Jul 18, 2022 at 16:06
  • 1
    Yeah the setup is a bit original. There is a program running out of their user directory that can interface with other files at or below the root dir of the program. I'd like them to be able to modify specific files that the program can then leverage. But there are some sensitive files the program needs that I do not want the users to have access to.
    – user534166
    Jul 18, 2022 at 20:27

1 Answer 1

Reset to default
0

You might get what you are looking for with the following steps:

  1. recursively giving only owners access to all files and folders in the user directory (only root or file owner will have access to everything):

    chmod -R 700 /home/<user_dir>/

  2. Give users and groups access to the chroot so they can list files when using sftp (after running this your sftp user will be able to list the contents in the user directory):

    chmod 755 /home/<user_dir>/

  3. Give users ownership of a file or recursive ownership over a directory you want them to have full access to:

    chown /home/<user_dir>/file

or

chown -R /home/<user_dir>/dir

You can repeat steps 2 and 3 as you see fit to get them access wherever they need. Hope this helps!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .