Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am trying to setup an sftp server and I am having issues getting it to work exactly as I like.

My server has two hard drives, the first is used for the os, and it contains all of the users home directories. My second drive contains all of the data that I would like to be able to share with specific users.

I want to prevent users (except for myself) from being able to ssh into the server, and I would like all users to be able to use sftp to transfer data to and from my "data" drive.

Limiting ssh access was easy. I created the group "ssh_users", added my account to it, and added AllowGroups ssh_users to the sshd_config file.

Getting the sftp to work as I want it to has been a struggle. I thought chrooting users to the data drive would work, but maybe I don't have permissions setup correctly?

What can I do to get this working? Thanks

share|improve this question

2 Answers 2

I wrote an article about that some time ago: http://en.positon.org/post/SFTP-chroot-rsync

I think what you need in /etc/ssh/sshd_config is:

# we use openssh internal sftp
# because /usr/lib/openssh/sftp-server won't be available in chroot
Subsystem sftp internal-sftp

Match group sftp
        ChrootDirectory %h
        X11Forwarding no
        AllowTcpForwarding no
        ForceCommand internal-sftp

You can change the ChrootDirectory to your need, however, the chroot directory have to be owned by root and not writeable by the users. This is a security restriction from the OpenSSH developers.

Also, carefully check /var/log/auth.log for SSH connections problems.

share|improve this answer

When you have local users who can use ftps you can mount the data drive into there home directories and then chroot their home directory.

mount --bind /data/drive /home/user/data

chroot_local_user=YES

With this setup the users have access to the data drive but, but can't list the filesystem om the primairy drive.

If you want you can limit permissions of the ftp users by adding them to a new group and give this group certain permissions on the data drive.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.