文档章节

搭建SFTP服务器(不允许SSH)

goodlook
 goodlook
发布于 2017/09/11 00:18
字数 912
阅读 15
收藏 0
点赞 0
评论 0

1. Create a New Group

Create a group called sftpusers. Only users who belong to this group will be automatically restricted to the SFTP chroot environment on this system.

# groupadd sftpusers

2. Create Users (or Modify Existing User)

Let us say you want to create an user guestuser who should be allowed only to perform SFTP in a chroot environment, and should not be allowed to perform SSH.

The following command creates guestuser, assigns this user to sftpusers group, make /incoming as the home directory, set /sbin/nologin as shell (which will not allow the user to ssh and get shell access).

# useradd -g sftpusers -d /incoming -s /sbin/nologin guestuser
# passwd guestuser

Verify that the user got created properly.

# grep guestuser /etc/passwd
guestuser:x:500:500::/incoming:/sbin/nologin

If you want to modify an existing user and make him an sftp user only and put him in the chroot sftp jail, do the following:

# usermod -g sftpusers -d /incoming -s /sbin/nologin john

On a related note, if you have to transfer files from windows to Linux, use any one of the sftp client mentioned in this top 7 sftp client list.

3. Setup sftp-server Subsystem in sshd_config

You should instruct sshd to use the internal-sftp for sftp (instead of the default sftp-server).

Modify the the /etc/ssh/sshd_config file and comment out the following line:

#Subsystem       sftp    /usr/libexec/openssh/sftp-server

Next, add the following line to the /etc/ssh/sshd_config file

Subsystem       sftp    internal-sftp
# grep sftp /etc/ssh/sshd_config
#Subsystem      sftp    /usr/libexec/openssh/sftp-server
Subsystem       sftp    internal-sftp

4. Specify Chroot Directory for a Group

You want to put only certain users (i.e users who belongs to sftpusers group) in the chroot jail environment. Add the following lines at the end of /etc/ssh/sshd_config

# tail /etc/ssh/sshd_config
Match Group sftpusers
        ChrootDirectory /sftp/%u
        ForceCommand internal-sftp

In the above:

  • Match Group sftpusers – This indicates that the following lines will be matched only for users who belong to group sftpusers
  • ChrootDirectory /sftp/%u – This is the path that will be used for chroot after the user is authenticated. %u indicates the user. So, for john, this will be /sftp/john.
  • ForceCommand internal-sftp – This forces the execution of the internal-sftp and ignores any command that are mentioned in the ~/.ssh/rc file.

5. Create sftp Home Directory

Since we’ve specified /sftp as ChrootDirectory above, create this directory (which iw equivalent of your typical /home directory).

# mkdir /sftp

Now, under /sftp, create the individual directories for the users who are part of the sftpusers group. i.e the users who will be allowed only to perform sftp and will be in chroot environment.

# mkdir /sftp/guestuser

So, /sftp/guestuser is equivalent to / for the guestuser. When guestuser sftp to the system, and performs “cd /”, they’ll be seeing only the content of the directories under “/sftp/guestuser” (and not the real / of the system). This is the power of the chroot.

So, under this directory /sftp/guestuser, create any subdirectory that you like user to see. For example, create a incoming directory where users can sftp their files.

# mkdir /sftp/guestuser/incoming

6. Setup Appropriate Permission

For chroot to work properly, you need to make sure appropriate permissions are setup properly on the directory you just created above.

Set the owenership to the user, and group to the sftpusers group as shown below.

# chown guestuser:sftpusers /sftp/guestuser/incoming

The permission will look like the following for the incoming directory.

# ls -ld /sftp/guestuser/incoming
drwxr-xr-x 2 guestuser sftpusers 4096 Dec 28 23:49 /sftp/guestuser/incoming

The permission will look like the following for the /sftp/guestuser directory

# ls -ld /sftp/guestuser
drwxr-xr-x 3 root root 4096 Dec 28 23:49 /sftp/guestuser

# ls -ld /sftp
drwxr-xr-x 3 root root 4096 Dec 28 23:49 /sftp

7. Restart sshd and Test Chroot SFTP

Restart sshd:

# service sshd restart

Test chroot sftp environment. As you see below, when gusetuser does sftp, and does “cd /”, they’ll only see incoming directory.

# sftp guestuser@thegeekstuff.com
guestuser@thegeekstuff's password:

sftp> pwd
Remote working directory: /incoming

sftp> cd /
sftp> ls
incoming

When guestuser transfers any files to the /incoming directory from the sftp, they’ll be really located under /sftp/guestuser/incoming directory on the system.

Note: If you have encountered below error: 
Write failed: Broken pipe
Couldn't read packet: Connection reset by peer

Make sure the chroot directory (/sftp/guestuser) has to be owned by root and can't be any group-write access. Lovely. So you essentially need to turn your chroot into a holding cell and within that you can have your editable content.

Use the following command:

chown root:root /sftp/guestuser

 

 

Implement Logging

 

1. Make syslog available in the chroot

Create a dev directory in each user’s chrooted directory:

# mkdir /sftp/guestuser/dev

The folder permission should be rwxr-xr-x.

 

2. Configure rsyslog to probe the new logging source

Put the following contents in /etc/rsyslog.conf :

# Create an additional socket for the sshd chrooted users.

$AddUnixListenSocket /sftp/guestuser/dev/log

 

3. Configure OpenSSH for logging

Modify the following contents in /etc/ssh/sshd_config:

Match Group sftpusers

ChrootDirectory /sftp/%u

X11Forwarding no

AllowTcpForwarding no

ForceCommand internal-sftp -f LOCAL7 -l INFO

 

4. Restart sshd and rsyslog Service

# service sshd restart

# service rsyslog restart

 

5. Verify file log

Log in to the SFTP server using comfort account

Verify log in /var/log/secure

本文转载自:http://www.thegeekstuff.com/2012/03/chroot-sftp-setup/

共有 人打赏支持
goodlook
粉丝 2
博文 31
码字总数 13095
作品 0
杭州
CentOS安装SFTP

服务器以centOS为例. 首先为什么要搭建sftp?答案:允许某些用户上传及下载文件,但是这些用户只能使用sftp传送文件,不能使用SSH终端访问服务器,而且sftp不能访问系统文件 创建sftp组 添加一个...

eatnothing ⋅ 2016/12/01 ⋅ 0

Ubuntu Server如何配置SFTP(建立用户监狱)

SSH File Transfer Protocol是一个比普通FTP更为安全的文件传输协议。(参考资料:http://en.wikipedia.org/wiki/SSHFileTransfer_Protocol)它工作在Secure Shell(SSH)上,确保文件被加密...

BearCatYN ⋅ 2015/08/25 ⋅ 0

Linux命令之sftp - 安全文件传输命令行工具

用途说明 sftp命令可以通过ssh来上传和下载文件,是常用的文件传输工具,它的使用方式与ftp类似,但它使用ssh作为底层传输协议,所以安全性比ftp要好得多。 常用方式 格式:sftp 通过sftp连接...

898009427 ⋅ 2017/12/14 ⋅ 0

Ubuntu14.04创建ftp服务器

在Ubuntu 14.04 上安装 FTP 服务 第一步>>更新库 第二步>>采用如下命令安装VSFTPD的包 第三步>>安装完成后打开 /etc/vsftpd.conf 文件,按如下所述修改。 取消如下行的注释(行号为29和33) ...

楠木楠 ⋅ 2016/12/20 ⋅ 0

SFTP服务器搭建

今天公司业务部门说要测试一款产品,需要FTP服务器,本来想给他们使用pure-ftp,但是他们指定要SFTP服务器。 我从来都没搭建过,正好借此机会部署测试一下 SFTP访问会使用本地系统账号,而非...

myexam ⋅ 2017/03/26 ⋅ 0

CentOS配置sftp服务器

CentOS配置sftp服务器 1、查看openssh的版本 ssh -V 版本必须大于4.8p1,低于的这个版本需要升级。 2、创建sftp组 groupadd sftp 2、创建2个sftp用户,用户名为test1和test2,密码为同用户名...

fuvip ⋅ 2017/11/23 ⋅ 0

Centos 6基于ssh搭建SFTP

使用ssh -V 命令来查看openssh的版本,版本必须大于4.8p1,低于的这个版本需要升级 不过基于Centos自带的ssh来搭建对账号管理等很不方便,是否使用,请执行考虑。 #创建sftp数据目录 mkdir ...

startuppp ⋅ 2017/06/15 ⋅ 0

Openssh服务器的搭建,并使用PSFTP实现文件自动上传,下载的script命令

才来这家公司被分配一个任务协助经理完成SSH Server的搭建,并且要实现客户端直接向服务器端上传文件。OK废话少说首先先来搭建服务器的步骤! (1)下载 服务器端我们使用openssh,它自带了c...

jihuayu ⋅ 2011/05/18 ⋅ 0

CentOS 7.4 配置sftp服务

服务搭建 CentOS自带 SSH 服务,直接配置即可 SFTP 配置 1.创建用户组 sftp groupadd sftp 2.创建用户 useradd -g sftp -s /sbin/nologin -d /home/sftp/ftpuser1 ftpuser1 -g 加入到sftp组 ...

瑞克-rick ⋅ 01/06 ⋅ 0

SSH和SFTP详解

传统FTP在传输机制和实现原理上是没有考虑安全机制的,因为它们在网络上用明文传送数据、用户帐号和用户口令,别有用心的人非常容易地就可以截获这些数据、用户帐号和用户口令。而且,这些网...

Junn ⋅ 2013/07/25 ⋅ 0

没有更多内容

加载失败,请刷新页面

加载更多

下一页

用ZBLOG2.3博客写读书笔记网站能创造今日头条的辉煌吗?

最近两年,著名的自媒体网站今日头条可以说是火得一塌糊涂,虽然从目前来看也遇到了一点瓶颈,毕竟发展到了一定的规模,继续增长就更加难了,但如今的今日头条规模和流量已经非常大了。 我们...

原创小博客 ⋅ 今天 ⋅ 0

MyBatis四大核心概念

本文讲解 MyBatis 四大核心概念(SqlSessionFactoryBuilder、SqlSessionFactory、SqlSession、Mapper)。 MyBatis 作为互联网数据库映射工具界的“上古神器”,训有四大“神兽”,谓之:Sql...

waylau ⋅ 今天 ⋅ 0

以太坊java开发包web3j简介

web3j(org.web3j)是Java版本的以太坊JSON RPC接口协议封装实现,如果需要将你的Java应用或安卓应用接入以太坊,或者希望用java开发一个钱包应用,那么用web3j就对了。 web3j的功能相当完整...

汇智网教程 ⋅ 今天 ⋅ 0

2个线程交替打印100以内的数字

重点提示: 线程的本质上只是一个壳子,真正的逻辑其实在“竞态条件”中。 举个例子,比如本题中的打印,那么在竞态条件中,我只需要一个方法即可; 假如我的需求是2个线程,一个+1,一个-1,...

Germmy ⋅ 今天 ⋅ 0

Springboot2 之 Spring Data Redis 实现消息队列——发布/订阅模式

一般来说,消息队列有两种场景,一种是发布者订阅者模式,一种是生产者消费者模式,这里利用redis消息“发布/订阅”来简单实现订阅者模式。 实现之前先过过 redis 发布订阅的一些基础概念和操...

Simonton ⋅ 今天 ⋅ 0

error:Could not find gradle

一.更新Android Studio后打开Project,报如下错误: Error: Could not find com.android.tools.build:gradle:2.2.1. Searched in the following locations: file:/D:/software/android/andro......

Yao--靠自己 ⋅ 昨天 ⋅ 0

Spring boot 项目打包及引入本地jar包

Spring Boot 项目打包以及引入本地Jar包 [TOC] 上篇文章提到 Maven 项目添加本地jar包的三种方式 ,本篇文章记录下在实际项目中的应用。 spring boot 打包方式 我们知道,传统应用可以将程序...

Os_yxguang ⋅ 昨天 ⋅ 0

常见数据结构(二)-树(二叉树,红黑树,B树)

本文介绍数据结构中几种常见的树:二分查找树,2-3树,红黑树,B树 写在前面 本文所有图片均截图自coursera上普林斯顿的课程《Algorithms, Part I》中的Slides 相关命题的证明可参考《算法(第...

浮躁的码农 ⋅ 昨天 ⋅ 0

android -------- 混淆打包报错 (warning - InnerClass ...)

最近做Android混淆打包遇到一些问题,Android Sdutio 3.1 版本打包的 错误如下: Android studio warning - InnerClass annotations are missing corresponding EnclosingMember annotation......

切切歆语 ⋅ 昨天 ⋅ 0

eclipse酷炫大法之设置主题、皮肤

eclipse酷炫大法 目前两款不错的eclipse 1.系统设置 Window->Preferences->General->Appearance 2.Eclipse Marketplace下载【推荐】 Help->Eclipse Marketplace->搜索‘theme’进行安装 比如......

anlve ⋅ 昨天 ⋅ 0

没有更多内容

加载失败,请刷新页面

加载更多

下一页

返回顶部
顶部