2

I have an SFTP server running on Ubuntu Server 12.04 LTS. Any users in the 'sftponly' group are chrooted into their home directory upon connection. As OpenSSH requires the ChrootDirectory to be owned by root, each user has a sub-folder named 'upload' that they have permission to write to. This all works well, and users are restricted to their own area, whether they are aware of it or not.

I would now like to provide access via HTTP/HTTPS for users to download files using just a web browser. I have been looking into Apache's mod_userdir, but this seems to be geared more towards anonymous access. I would like the system to require the user to authenticate before being able to download from their folder. It should also only allow them to download from their folder.

For example, a user would visit https://download.example.com/testuser/file.zip and be required to authenticate using the same credentials as they would when connecting via SFTP to download the file.

I've been looking into solutions like creating a seperate virtual host for each user, and manually creating htaccess files in each home dir, but they seem kind of untidy.

Any suggestions greatly appreciated.

1

You need Apache to integrate with PAM for its authentication. This is fairly easily done through pwauth and mod_authnz_external. You can read more on the details here:

The problem is I can't see any way to hook that into the userdir module. pwauth will let you specify requires user <username> but I can't see how to combine the two. And trust me when I say I've searched.

I think the easiest method for this would be to manually hold an entry for each and every user:

<Directory /users/abed/>
    DocumentRoot /home/abed/public_html/
    AuthType Basic
    AuthName "Restricted Area"
    AuthBasicProvider external
    AuthExternal pwauth
    Require user abed
</Directory>

<Directory /users/britta/>
    DocumentRoot /home/britta/public_html/
    AuthType Basic
    AuthName "Restricted Area"
    AuthBasicProvider external
    AuthExternal pwauth
    Require user britta
</Directory>

And so on. You could even script something to regenerate this on a periodic basis. It's not a hard template structure to follow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.