sftp settings on server ubuntu 18.04

Question

today I started to work on SFTP setting to implement a real-time sync.

despite the basic default consiguration /etc/ssh/ssh_config file

host *
SendEnv LANG LC_*
HashKnownHosts yes
GSSAPIAuthentication yes

the server do not follow this config file. By instance after creating few users, despite I used

DenyUsers USER1,USER2

I could still connect remotely with SSH

As well despite there is no Subsystem about sftp I can access via sftp $sftp user1@remote.host

I also followed this link but when I was logged in I could move around the whole file system and could not restrict the user to one directory

At the end it seams to me there are some other files overriding the default setting file or there is something I can't see.

General question: after every change to the file /etc/ssh/ssh_config I restarted the ssh daemon with

service ssh restart

Considering I work remotely with the server via ssh, should not the connection drop after every restart? This do not happen

thanks

Answer 1

Please do the following

• edit /etc/ssh/sshd_config
• make sure you create a sftpuser and sftp group
• make sure there is a directory with root ownership that you will use as chroot e.g. sftpdir
• i attach a SFTP configuration that allows SSH over port 22 and SFTP on a random port. It blocks SSH access and only allows SFTP access to that sftpuser. The secret is in using the internal-sftp subsystem and the Match clauses.
• restart sshd and check status

# This is the sshd server. Configured for SFTP access on a random port.
# See sshd_config(5) for more information.
Port 279
Port 22
PasswordAuthentication no
ChallengeResponseAuthentication no

# Cipher suite
KexAlgorithms +diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
Ciphers +3des-cbc,aes128-cbc,aes128-ctr,aes256-ctr
#+blowfish-cbc
#,
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
X11Forwarding no
PrintMotd no
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem    sftp    internal-sftp
# Allow SSH over port 22 for Ubuntu but truncate SFTP.
Match User ubuntu  LocalPort 22
  ForceCommand "/bin/bash"
Match User ubuntu LocalPort 279
    ForceCommand exit
PermitTunnel no
AllowAgentForwarding no
X11Forwarding no
AllowTcpForwarding no
# Allow special feature on Random port 279
Match LocalPort 279 group sftp
  ChrootDirectory /home/sftpdir

Answer 2

I was just building my SFTP server and came across your question. I have followed This Article and users don't have shell access, and can only access their home dirs only.