0

today I started to work on SFTP setting to implement a real-time sync.

despite the basic default consiguration /etc/ssh/ssh_config file

host *
SendEnv LANG LC_*
HashKnownHosts yes
GSSAPIAuthentication yes

the server do not follow this config file. By instance after creating few users, despite I used

DenyUsers USER1,USER2

I could still connect remotely with SSH

As well despite there is no Subsystem about sftp I can access via sftp $sftp user1@remote.host

I also followed this link but when I was logged in I could move around the whole file system and could not restrict the user to one directory

At the end it seams to me there are some other files overriding the default setting file or there is something I can't see.

General question: after every change to the file /etc/ssh/ssh_config I restarted the ssh daemon with

service ssh restart

Considering I work remotely with the server via ssh, should not the connection drop after every restart? This do not happen

thanks

5
  • You appear to be editing the client-side configuration file - the server-side configuration is in /etc/ssh/sshd_config Feb 15, 2019 at 18:18
  • I edit the server side file...and this is driving me crazy!!
    – gipsea
    Feb 15, 2019 at 18:29
  • accordingly to the file list find here: [link]packages.ubuntu.com/bionic/i386/openssh-client/filelist the file /etc/ssh/ssh_config come with the openssh-client although in all tutorial this is the file referred to be server config file. any hint?
    – gipsea
    Feb 16, 2019 at 9:29
  • The instructions in the link you posted clearly say to edit the sshd_config file (sudo nano /etc/ssh/sshd_config) Feb 16, 2019 at 10:04
  • ciao @steeldriver ... I've just figured out too!!! Thanks to everyone
    – gipsea
    Feb 17, 2019 at 16:14

2 Answers 2

1

Please do the following

  • edit /etc/ssh/sshd_config
  • make sure you create a sftpuser and sftp group
  • make sure there is a directory with root ownership that you will use as chroot e.g. sftpdir
  • i attach a SFTP configuration that allows SSH over port 22 and SFTP on a random port. It blocks SSH access and only allows SFTP access to that sftpuser. The secret is in using the internal-sftp subsystem and the Match clauses.
  • restart sshd and check status
# This is the sshd server. Configured for SFTP access on a random port.
# See sshd_config(5) for more information.
Port 279
Port 22
PasswordAuthentication no
ChallengeResponseAuthentication no

# Cipher suite
KexAlgorithms +diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
Ciphers +3des-cbc,aes128-cbc,aes128-ctr,aes256-ctr
#+blowfish-cbc
#,
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
X11Forwarding no
PrintMotd no
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem    sftp    internal-sftp
# Allow SSH over port 22 for Ubuntu but truncate SFTP.
Match User ubuntu  LocalPort 22
  ForceCommand "/bin/bash"
Match User ubuntu LocalPort 279
    ForceCommand exit
PermitTunnel no
AllowAgentForwarding no
X11Forwarding no
AllowTcpForwarding no
# Allow special feature on Random port 279
Match LocalPort 279 group sftp
  ChrootDirectory /home/sftpdir
1
  • good idea, but the drawback is when creating multople users .. he will have to edit this file and add the new user everytime .. you can check my answer, I've followed an article and was able to match it with only the group, and only 5 lines to be added to the /etc/ssh/sshd_config file
    – sikas
    Feb 7, 2021 at 17:10
0

I was just building my SFTP server and came across your question. I have followed This Article and users don't have shell access, and can only access their home dirs only.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.