On my Ubuntu 16.04 LTS server, I would like to do the following things:
- Enable a non-root admin user with sudo privileges to SSH in to the server using an RSA key (no password)
- Enable selected non-admin users to upload files by SFTP to their own home directory, using a password to log in
- Prevent the non-admin users from gaining access to the rest of the file system
I'm working with a freshly-installed version of Ubuntu 16.04.3 LTS, so everything is in its default factory condition.
I have read this question and the answers carefully, but I have not been able to find a solution.
I have created a
nonrootadmin user with sudo privileges.
I have created a
nonadminsftp user who is a member of the
sftpaccess group. The
/home/nonadminsftp/ directory looks like this:
$ ls -al ~nonadminsftp total 24 drwxr-xr-x 3 root root 4096 Oct 25 00:52 . drwxr-xr-x 5 root root 4096 Oct 24 22:29 .. -rw-r--r-- 1 nonadminsftp sftpaccess 220 Sep 1 2015 .bash_logout -rw-r--r-- 1 nonadminsftp sftpaccess 3771 Sep 1 2015 .bashrc drwxr-xr-x 3 nonadminsftp sftpaccess 4096 Oct 25 00:50 ftp -rw-r--r-- 1 nonadminsftp sftpaccess 655 May 16 13:49 .profile
Their respective entries in
/etc/passwd are as follows:
The changes I have made to the
/etc/sshd/sshd_config file are as follows:
PermitRootLogin no #PasswordAuthentication no AllowUsers nonrootadmin nonadminsftp Subsystem sftp internal-sftp Match group sftpaccess #ChrootDirectory %h X11Forwarding no AllowTcpForwarding no #ForceCommand internal-sftp
The solution that I have seen proposes uncommenting 3 of these lines, but I discover that:
PasswordAuthentication noprevents the nonadminsftp user from connecting with a password:
$ sftp firstname.lastname@example.org Permission denied (publickey). Couldn't read packet: Connection reset by peer
ChrootDirectory %hprevents the nonrootadmin user from connecting at all:
$ ssh email@example.com packet_write_wait: Connection to 22.214.171.124 port 22: Broken pipe`
ForceCommand internal-sftpprevents the nonrootadmin from gaining SSH access:
$ ssh firstname.lastname@example.org This service allows sftp connections only. Connection to mydomain.com closed.`
With these lines commented out:
- nonrootadmin does have SSH access using an RSA key
- nonadminsftp can connect using a FTP client such as FileZilla
- nonadminsftp is not
chrooted to the
- nonrootadmin can log in with a password
What is it that I am missing?
Thanks in advance