How to provide Secure Isolated (Restricted) SFTP Access for file transfer

Often we need to provide secure but restricted sftp access to our clients to upload or download large files.

Regular sftp accounts allow the users to view login names of other users/clients and in many default installations even allow them to browse through the directories and files. In addition, they can also view your system files and any unprotected files and directories including much of your system settings under etc.

When you provide sftp access, you also provide ssh access (sftp is a subsystem of ssh) and as such users can login.

We address these issues by enclosing the user’s home directory in chroot jail, which makes it impossible for the user to break out of his home directory and view other’s files and directories.

Follow the steps below to configure your system.

As root (or sudo) modify /etc/ssh/sshd_config:Change Subsystem sftp line to:

Subsystem sftp internal-sftp

Add this to the end of the file:

Match Group sftp
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp

Save the changes and restart OpenSSH:

sudo service ssh restart

Create a system group for users with restricted sftp access:

addgroup --system sftp

Now you can add users with addsftpuser and delete with delsftpuser from GitHub project restricted-sftp.

Clone the repository with:

git clone https://github.com/angsuman/restricted-sftp.git

Copy the files addsftpuser and delsftpuser to your ~/bin or any other directory in your PATH like /usr/bin.

Run it with by specifying the login name of the sftp user:

addsftpuser new-login

The only downside is that the user cannot upload/download files and directories under his home directory directly (as it is owned by root) but can do under Files sub-directory. There you have full access and can upload/download/delete/rename files and directories. To create additional directories under home, edit the addftpuser script and create them following the same procedure as Files.

Nirvana Satkam

॥ निर्वाण षटकम्॥

मनोबुद्ध्यहङ्कार चित्तानि नाहं

 

न च श्रोत्रजिह्वे न च घ्राणनेत्रे ।

 

न च व्योम भूमिर्न तेजो न वायुः

 

चिदानन्दरूपः शिवोऽहम् शिवोऽहम् ॥१॥

I am neither the mind, nor the intellect, nor the ego, nor the mind-stuff ;
I am neither the body, nor the changes of the body ;
I am neither the senses of hearing, taste, smell, or sight,
Nor am I the ether, the earth, the fire, the air ;
I am Existence Absolute, Knowledge Absolute, Bliss Absolute—
I am He, I am He. (Shivoham, Shivoham).

न च प्राणसंज्ञो न वै पञ्चवायु


न वा सप्तधातुः न वा पञ्चकोशः ।


न वाक्पाणिपादं न चोपस्थपायु


चिदानन्दरूपः शिवोऽहम् शिवोऽहम् ॥२॥

I am neither the Prâna, nor the five vital airs ;
I am neither the materials of the body, nor the five sheaths ;
Neither am I the organs of action, nor object of the senses ;
I am Existence Absolute, Knowledge Absolute, Bliss Absolute—
I am He, I am He. (Shivoham, Shivoham).

न मे द्वेषरागौ न मे लोभमोहौ

 

मदो नैव मे नैव मात्सर्यभावः ।

 

न धर्मो न चार्थो न कामो न मोक्षः

 

चिदानन्दरूपः शिवोऽहम् शिवोऽहम् ॥३॥

 

I have neither aversion nor attachment, neither greed nor delusion;
Neither egotism nor envy, neither Dharma nor Moksha;
I am neither desire nor objects of desire ;
I am Existence Absolute, Knowledge Absolute, Bliss Absolute—
I am He, I am He. (Shivoham, Shivoham).

न पुण्यं न पापं न सौख्यं न दुःखं

 

न मन्त्रो न तीर्थो न वेदो न यज्ञ ।

 

अहं भोजनं नैव भोज्यं न भोक्ता

 

चिदानन्दरूपः शिवोऽहम् शिवोऽहम् ॥४॥

I am neither sin nor virtue, neither pleasure nor pain ;
Nor temple nor worship, nor pilgrimage nor scriptures,
Neither the act of enjoying, the enjoyable nor the enjoyer ;
I am Existence Absolute, Knowledge Absolute, Bliss Absolute—
I am He, I am He. (Shivoham, Shivoham).

न मृत्युर्न शङ्का न मे जातिभेदः

 

पिता नैव मे नैव माता न जन्मः ।

 

न बन्धुर्न मित्रं गुरुर्नैव शिष्यं

 

चिदानन्दरूपः शिवोऽहम् शिवोऽहम् ॥५॥

I have neither death nor fear of death, nor caste ;
Nor was I ever born, nor had I parents, friends, and relations ;
I have neither Guru, nor disciple ;
I am Existence Absolute, Knowledge Absolute, Bliss Absolute—
I am He, I am He. (Shivoham, Shivoham).

अहं निर्विकल्पो निराकाररूपो

 

विभुत्वाच्च सर्वत्र सर्वेन्द्रियाणाम् ।

 

न चासङ्गतं नैव मुक्तिर्न मेयः

 

चिदानन्दरूपः शिवोऽहम् शिवोऽहम् ॥६॥

I am untouched by the senses, I am neither Mukti nor knowable ;
I am without form, without limit, beyond space, beyond time ;
I am in everything ; I am the basis of the universe ; everywhere am I.
I am Existence Absolute, Knowledge Absolute, Bliss Absolute—
I am He, I am He. (Shivoham, Shivoham).

How to list all URL's in Redirect chain

This simple utility is extremely useful in detecting bad redirects and loops, specially in big websites. You can also include it in scripts.

wget http://gmail.com 2>&1 | grep Location:

The response, in this case, is:

Location: https://www.google.com/gmail/ [following]
Location: https://mail.google.com/mail/ [following]
Location: https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=https://mail.google.com/mail/&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1&osid=1# [following]

Pros and Cons of Hosting your own Nameservers

Benefits of hosting your Nameservers

  • Ease of changing hosting providers: Having your own nameservers make it easy when you are changing your hosting providers for two reasons:
    • Zero downtime in switching
    • Minimal change on Domain Register (change Nameserver and Hostname reords only)
    • Other nameserver changes can be done easily with your own nameserver, even scripted
  • Vanity Name Servers: Your clients may, particularly if you are in reseller business, check your Domain records including your name servers in a bid to identify your genuineness and commitment.
  • Ease of managing nameserver: You can easily script it or use User interface of your choice.

Disadvantages of hosting your own nameservers

  • Need Knowledge: You need to understand DNS well and be conversant in managing nameservers.  Messing up DNS records while client is shouting is not a good experience to have
  • Responsible for Security: You need to ensure that the Nameserver Software is always updated and protect it against all DNS attack vectors
  • Responsible for performance: If you are using the server for other purposes, most likely you are, then your nameserver performance is dependent on the load of the system. When your system is overloaded, havinbg the namserver also slow down adds to the load and more importantly aggravates the problem. You need to ensure performance of your namservers
  • Responsible for redundancy: There should be at least two namservers for redundancy and failover. Unless you have multiple servers that you can use, you are removing redundancy by pointing both the nameseerver IP at the same server.

Domain name registrars nowadays provide free DNS services to better retain their clients by:

  • making it harder to switch
  • giving better value for money

I have done both and I find using Domain registrars service gives less headache but is harder to configure and boring when you have large number of domains.

OVH: How to add Additional IP Addresses (IP Alias) on Ubuntu 16.04 / 18.04

Adding additional IP addresses in OVH is rather unconventional and the guide they point to in their mail is non-existent. The process, fortunately, is simple:

  1. ssh to the server as root
  2. cd /etc/systemd/network/
  3. vi *-default.network
  4. Add the new IP address after the original IPv4 Address
    DHCP=no
    Address=Main_IP/24
    Address=Failover_IP/32
  5. Save and close the file
  6. Reboot the server

You should now be able to ssh to the server using the new IP Address (which OVH likes to call Failover IP Address) in addition to the old one.
Repeat the process for any additional IP addresses.
Note: I have tested it on two different OVH Servers (in France & Canada) for Ubuntu 16.04 and Ubuntu 18.04.

Chrome: How to view YouTube at 3x Speed

When viewing a YouTube video you may want to quickly skip through introductory section or boring/repetitive parts. The following solution will allow you to toggle between high speed and normal viewing. 3x speed-up is not offered by YouTube. With little practice you can understand even at that high speed, you need to be a bit focussed. May help increase your power of concentration.
Drag this link to your bookmarks toolbar: 3x
The bookmarklet is a toggle. Click once to view the video at 3x speed, click again to switch to normal mode.