2

I have a cluster of machines (LAN) set up for password-less SSH login for running code in parallel. No problems with the SSH or functionality, however...

I'm trying to set up an sftp-only (no shell) user on the gateway machine for external (outside the cluster) file transfers to the gateway machine. I created a new group and user following the guide here (http://blog.swiftbyte.com/linux/allowing-sftp-access-while-chrooting-the-user-and-denying-shell-access/), and edited the /etc/ssh/sshd_config file as appropriate. However, when I restart the ssh server, the gateway machine is no longer accessible through SSH or SFTP. Any attempt is met with a "connection refused" message. If I switch back to the original sshd_config file, I can connect again.

Is there any known issue with setting Subsystem sftp internal-sftp that causes SSH functionality to disappear? Or any suggestions for something I might be missing?

My sshd_config file addition is as follows:

Subsystem sftp internal-sftp
Match Group sftponly
   ChrootDirectory %h
   X11Forwarding no
   AllowTcpForwarding no
   ForceCommand internal-sftp

My sftp-user has their home directory specified on an external drive that is auto-mounted at boot. Their home directory has root ownership and 755 permission.

2
  • 1
    It turns out that the Match Group block of code must be inserted at the end of the sshd_config file. Many guides don't explicitly state this and so I overlooked it and thought the code belonged together with the Subsystem line. SSH works fine again; SFTP, however, still isn't connecting (giving a "broken pipe" error).
    – Fexar
    Apr 1, 2013 at 19:47
  • SFTP issue resolution: The external drive is mounted to /mnt/DATA/ with 777 permissions so that everyone can read/write to it. I created a sub-directory /mnt/DATA/sftp/ for the sftp user with 750 permissions and root-ownership which I thought would be sufficient. Unfortunately, sftp requires the entire directory structure to have root/750, including the /mnt/DATA/ directory. So sftp works, but I can't let physical users create new folders inside the base /mnt/DATA/ directory now. Not 100% what I want, but at least it's a step in the right direction.
    – Fexar
    Apr 1, 2013 at 20:04

2 Answers 2

1

It turns out that the Match Group block of code must be inserted at the end of the sshd_config file. Many guides don't explicitly state this and so I overlooked it and thought the code belonged together with the Subsystem line. SSH works fine again; SFTP, however, still isn't connecting (giving a "broken pipe" error).

SFTP issue resolution: The external drive is mounted to /mnt/DATA/ with 777 permissions so that everyone can read/write to it. I created a sub-directory /mnt/DATA/sftp/ for the sftp user with 750 permissions and root-ownership which I thought would be sufficient. Unfortunately, sftp requires the entire directory structure to have root/750, including the /mnt/DATA/ directory. So sftp works, but I can't let physical users create new folders inside the base /mnt/DATA/ directory now. Not 100% what I want, but at least it's a step in the right direction.

Answer posted by OP in comments

0

Sorry, I can't comment to your message so then that way. You are setting a standard SFTP group which can connect through SFTP. I noticed that after putting a SSH user into the SFTP user group ubuntu automatically changes the chroot look-up and deny further SSH access. Just pure SFTP access is possible then and jailed to the usermod -d folder. Removing the user from that SFTP group allowed SSH login again.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .