SFTP with Active Directory authentication (RealmD and SSSD)

Question

What it should look like: My Ubuntu VM is connected through SSSD to my Active Directory Server. I want an SFTP Server that jails incomming Users that have a specific AD Group (USR-SFTP@domain) assigned and only SFTP and not SSH. My Admin Users with the their Group assigned (Domain-Admins@domain) should still be able to log in through SSH but not SFTP.

How it is now: I got SSSD working fine. SFTP is making me issues.

sssd.conf:

[sssd]
domains = domain
config_file_version = 2
services = nss, pam
default_domain_suffix = domain

[domain/domain]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = domain
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%u@%d
ad_domain = domain
use_fully_qualified_names = True
ldap_id_mapping = True
access_provider = simple
simple_allow_groups = Domain-Admins@domain

sshd.conf:

Subsystem sftp internal-sftp

Match Group usr-sftp
        ChrootDirectory /appdata/SFTPdata/%u
        ForceCommand internal-sftp -d /upload
        AllowTcpForwarding no
        GatewayPorts no
        X11Forwarding no

Folder /appdata/SFTPdata/%u is owned by root. Folder /appdata/SFTPdata/%u/upload is owned by the user.

When I add the AD Group "usr-sftp" in the allowed Groups in the sssd.conf Im able to connect through ssh and sftp but get directed to /home.

I dont know what im doing wrong at this point.

Answer 1

It seems its not possible to have one Domain config in SSSD and be able to seperate Group permissions, or at least I did not find it. So my solution is as follow

sssd.conf

[sssd]
domains = domain1.lan, domain2.lan
config_file_version = 2
services = nss, pam
default_domain_suffix = domain.lan

[domain/domain1.lan]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = domain.LAN
realmd_tags = manages-system joined-with-adcli
id_provider = ad
overwrite_homedir = /appdata/SFTPdata/%u@%d
ad_domain = domain.lan
use_fully_qualified_names = True
ldap_id_mapping = True
access_provider = simple
simple_allow_groups = [email protected]

ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities
ldap_user_ssh_public_key = altSecurityIdentities
ldap_schema = ad

[domain/domain2.lan]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = domain.LAN
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%u@%d
ad_domain = domain.lan
use_fully_qualified_names = True
ldap_id_mapping = True
access_provider = simple
simple_allow_groups = Domä[email protected]

ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities
ldap_user_ssh_public_key = altSecurityIdentities
ldap_schema = ad

note: specify the Domain spaces you created under [sssd] (domains = domain1.lan, domain2.lan) Set the right Domain Name in the Config as shown but for simple_allow_groups use your specified Domain suffix ([email protected]) This config also includes SSH Public Key authentication.

I know that I dont have to use Full Names but in this case I want to use it as it makes like easier to log in through ssh or sftp. To be able to log in on the node with a Admin user you have to use ssh [email protected]@server. That's so far the only down side but I can live with that.

sshd_config:

ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
UseDNS no
PasswordAuthentication yes

AcceptEnv LANG LC_*

Subsystem sftp internal-sftp

AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
AuthorizedKeysCommandUser root

Match Group [email protected]
        ChrootDirectory /appdata/SFTPdata/%u
        AuthorizedKeysFile /appdata/SFTPdata/%u/.ssh/authorized_keys
        ForceCommand internal-sftp -d /upload
        AllowTcpForwarding no
        GatewayPorts no
        X11Forwarding no

With the SSSD Config in place im finally able to apply the sshd config fully as of now im able to resolve the ad groups and everything works. At this point the only important things are the right folder permissions.

/appdata <- root:root 755  
/appdata/SFTPdata <- root:root 700  
/appdata/SFTPdata/%u <- root:root 755  
/appdata/SFTPdata/%u/upload <- user:[email protected] 700  

There's probably a more efficient solution to this and I would be happy to know about it, but so far this made everything work.