How to create a SFTP (SSH) User with extremely limited permissions
Let's start
Create user ubuntu
sudo useradd ubuntu
Make password
sudo passwd ubuntu
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Create for SFTP only group
xxx@xxx:~$ sudo groupadd sftp_users
Add to a user "ubuntu" for SFTP only group
xxx@xxx:~$ sudo usermod -G sftp_users ubuntu
Make dir for sftp
access
sudo mkdir /ubuntu
Change owner, because read/write permission
sudo chown root.root /ubuntu/
Add permission
sudo chmod 755 /ubuntu/
Edit /etc/ssh/sshd_config
sudo nano /etc/ssh/sshd_config
Comment out and add a line like below
#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp
Add at the last
Match Group sftp_users
X11Forwarding no
AllowTcpForwarding no
ChrootDirectory /ubuntu
ForceCommand internal-sftp
Restart ssh
service
sudo service ssh restart
With this cenfiguration you can ssh into folder ubuntu
and get files. Can not put
or delete
Try.
Edit 1
To sftp in right folder edit /etc/passwd
. Change line for user ubuntu
to look like this
sudo nano /etc/passwd
ubuntu:x:1001:1001::/ubuntu:
This will change user ubuntu home folder to your sftp server folder.
Enabling
root
account is not good idea.
You can ssh to server with user1
.
If you add user user1
in sudoer group
you will be able to write in
folder /ubuntu/
and set appropriate permission
sudo adduser user1 sudo
Make folder, write in folder ubuntu. After actions you must set permission for user ubuntu
. Easiest way is to agai set permission to 755
sudo chmod 755 -R /ubuntu/
-R - option will give reading permission of all files and dir's for user ubuntu