2

I have a cluster of machines (LAN) set up for password-less SSH login for running code in parallel. No problems with the SSH or functionality, however...

I'm trying to set up an sftp-only (no shell) user on the gateway machine for external (outside the cluster) file transfers to the gateway machine. I created a new group and user following the guide here (http://blog.swiftbyte.com/linux/allowing-sftp-access-while-chrooting-the-user-and-denying-shell-access/), and edited the /etc/ssh/sshd_config file as appropriate. However, when I restart the ssh server, the gateway machine is no longer accessible through SSH or SFTP. Any attempt is met with a "connection refused" message. If I switch back to the original sshd_config file, I can connect again.

Is there any known issue with setting Subsystem sftp internal-sftp that causes SSH functionality to disappear? Or any suggestions for something I might be missing?

My sshd_config file addition is as follows:

Subsystem sftp internal-sftp
Match Group sftponly
   ChrootDirectory %h
   X11Forwarding no
   AllowTcpForwarding no
   ForceCommand internal-sftp

My sftp-user has their home directory specified on an external drive that is auto-mounted at boot. Their home directory has root ownership and 755 permission.

Improve this question
2
  • 1
    It turns out that the Match Group block of code must be inserted at the end of the sshd_config file. Many guides don't explicitly state this and so I overlooked it and thought the code belonged together with the Subsystem line. SSH works fine again; SFTP, however, still isn't connecting (giving a "broken pipe" error).
    – Fexar
    Apr 1, 2013 at 19:47
  • SFTP issue resolution: The external drive is mounted to /mnt/DATA/ with 777 permissions so that everyone can read/write to it. I created a sub-directory /mnt/DATA/sftp/ for the sftp user with 750 permissions and root-ownership which I thought would be sufficient. Unfortunately, sftp requires the entire directory structure to have root/750, including the /mnt/DATA/ directory. So sftp works, but I can't let physical users create new folders inside the base /mnt/DATA/ directory now. Not 100% what I want, but at least it's a step in the right direction.
    – Fexar
    Apr 1, 2013 at 20:04

2 Answers 2

Reset to default
1

It turns out that the Match Group block of code must be inserted at the end of the sshd_config file. Many guides don't explicitly state this and so I overlooked it and thought the code belonged together with the Subsystem line. SSH works fine again; SFTP, however, still isn't connecting (giving a "broken pipe" error).

SFTP issue resolution: The external drive is mounted to /mnt/DATA/ with 777 permissions so that everyone can read/write to it. I created a sub-directory /mnt/DATA/sftp/ for the sftp user with 750 permissions and root-ownership which I thought would be sufficient. Unfortunately, sftp requires the entire directory structure to have root/750, including the /mnt/DATA/ directory. So sftp works, but I can't let physical users create new folders inside the base /mnt/DATA/ directory now. Not 100% what I want, but at least it's a step in the right direction.

Answer posted by OP in comments

Improve this answer
0

Sorry, I can't comment to your message so then that way. You are setting a standard SFTP group which can connect through SFTP. I noticed that after putting a SSH user into the SFTP user group ubuntu automatically changes the chroot look-up and deny further SSH access. Just pure SFTP access is possible then and jailed to the usermod -d folder. Removing the user from that SFTP group allowed SSH login again.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.