TASIOMIND.DEV — OPERATIONAL▸▸▸FULL STACK DEVELOPER @ GWQ SERVICEPLUS AG▸▸▸FOUNDER — K8SGPT.AI▸▸▸OPEN SOURCE: ACTIVE▸▸▸DISTRIBUTED SYSTEMS / KUBERNETES / AI▸▸▸RUST + GO + PYTHON▸▸▸FIELD TESTED / STATUS — NOMINAL▸▸▸LOCATION: EUROPE/BERLIN▸▸▸TASIOMIND.DEV — OPERATIONAL▸▸▸FULL STACK DEVELOPER @ GWQ SERVICEPLUS AG▸▸▸FOUNDER — K8SGPT.AI▸▸▸OPEN SOURCE: ACTIVE▸▸▸DISTRIBUTED SYSTEMS / KUBERNETES / AI▸▸▸RUST + GO + PYTHON▸▸▸FIELD TESTED / STATUS — NOMINAL▸▸▸LOCATION: EUROPE/BERLIN▸▸▸
← sysadmin

SFTP Users for Website directory

August 9, 2017

Ziel

SFTP User ohne Shell, eingeschraenkt auf /var/www.

Wichtige Regeln

  • ChrootDirectory muss root:root gehoeren
  • ChrootDirectory braucht 755
  • SFTP Config am Ende von sshd_config

Setup (Kurz)

code
GROUP="sftpgrp"
USER="sftpuser"
CHROOT="/var/www"

sudo apt install -y openssh-server
sudo groupadd "$GROUP"
sudo useradd "$USER" -g "$GROUP"

sudo chown root:root "$CHROOT"
sudo chmod 755 "$CHROOT"

/etc/ssh/sshd_config (am Ende):

code
Subsystem sftp internal-sftp

Match Group sftpgrp
  ChrootDirectory /var/www
  ForceCommand internal-sftp
  PasswordAuthentication yes
  X11Forwarding no
  AllowTcpForwarding no
  AllowAgentForwarding no

Restart:

code
sudo service ssh restart

Schreibrechte fuer Webfiles

code
sudo usermod -aG www-data sftpuser
sudo chgrp -R www-data /var/www/*
sudo chmod -R g+w /var/www/*
find /var/www -type d -print0 | sudo xargs -0 chmod g+s

Troubleshooting

Server unexpectedly closed:

  • Chroot nicht root:root
  • Chroot nicht 755

Links