{"id":15782,"date":"2018-09-20T03:59:39","date_gmt":"2018-09-20T03:59:39","guid":{"rendered":"https:\/\/blog.taragana.com\/?p=15782"},"modified":"2018-09-20T04:54:00","modified_gmt":"2018-09-20T04:54:00","slug":"how-to-provide-secure-isolated-restricted-sftp-access-for-file-transfer","status":"publish","type":"post","link":"https:\/\/blog.taragana.com\/how-to-provide-secure-isolated-restricted-sftp-access-for-file-transfer-15782","title":{"rendered":"How to provide Secure Isolated (Restricted) SFTP Access for file transfer"},"content":{"rendered":"\n<p>Often we need to provide secure but restricted sftp access to our clients to upload or download large files.<\/p>\n\n\n\n<p>Regular sftp accounts allow the users to view login names of other users\/clients and in many default installations even allow them to browse through the directories and files. In addition, they can also view your system files and any unprotected files and directories including much of your system settings under etc.<\/p>\n\n\n\n<p>When you provide sftp access, you also provide ssh access (sftp is a subsystem of ssh) and as such users can login.<\/p>\n\n\n\n<p>We address these issues by enclosing the user&#8217;s home directory in chroot jail, which makes it impossible for the user to break out of his home directory and view other&#8217;s files and directories.<\/p>\n\n\n\n<p>Follow the steps below to configure your system.<\/p>\n\n\n\n<p> <\/p>\n\n\n\n<p>As root (or sudo) modify \/etc\/ssh\/sshd_config:Change Subsystem sftp line to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Subsystem sftp internal-sftp<\/code><\/pre>\n\n\n\n<p>Add this to the <strong>end<\/strong> of the file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Match Group sftp\n    ChrootDirectory %h\n    X11Forwarding no\n    AllowTcpForwarding no\n    ForceCommand internal-sftp<\/code><\/pre>\n\n\n\n<p>Save the changes and restart OpenSSH:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install whois\n<\/code><\/pre>\n\n\n\n<p>Create a system group for users with restricted sftp access:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>addgroup --system sftp<\/code><\/pre>\n\n\n\n<p>Now you can add users with <strong>addsftpuser<\/strong> and delete with <strong>delsftpuser<\/strong> from GitHub project <a href=\"https:\/\/github.com\/angsuman\/restricted-sftp\">restricted-sftp<\/a>.<\/p>\n\n\n\n<p>Clone the repository with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>git clone https:\/\/github.com\/angsuman\/restricted-sftp.git<\/code><\/pre>\n\n\n\n<p>Copy the files <strong>addsftpuser<\/strong> and <strong>delsftpuser<\/strong> to your ~\/bin or any other directory in your PATH like \/usr\/bin.<\/p>\n\n\n\n<p>Run it with by specifying the login name of the sftp user:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>addsftpuser new-login<\/code><\/pre>\n\n\n\n<p>The only downside is that the user cannot upload\/download files and directories under his home directory directly (as it is owned by root) but can do under <strong>Files<\/strong> sub-directory. There you have full access and can upload\/download\/delete\/rename files and directories. To create additional directories under home, edit the <strong>addftpuser<\/strong> script and create them following the same procedure as <strong>Files<\/strong>.<br\/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Often we need to provide secure but restricted sftp access to our clients to upload or download large files. Regular sftp accounts allow the users to view login names of other users\/clients and in many default installations even allow them to browse through the directories and files. In addition, they can also view your system [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[10],"tags":[129,128,109],"_links":{"self":[{"href":"https:\/\/blog.taragana.com\/wp-json\/wp\/v2\/posts\/15782"}],"collection":[{"href":"https:\/\/blog.taragana.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.taragana.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.taragana.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.taragana.com\/wp-json\/wp\/v2\/comments?post=15782"}],"version-history":[{"count":5,"href":"https:\/\/blog.taragana.com\/wp-json\/wp\/v2\/posts\/15782\/revisions"}],"predecessor-version":[{"id":15789,"href":"https:\/\/blog.taragana.com\/wp-json\/wp\/v2\/posts\/15782\/revisions\/15789"}],"wp:attachment":[{"href":"https:\/\/blog.taragana.com\/wp-json\/wp\/v2\/media?parent=15782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.taragana.com\/wp-json\/wp\/v2\/categories?post=15782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.taragana.com\/wp-json\/wp\/v2\/tags?post=15782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}