Comments on Mark Van den Borre: SFTP on Ubuntu and Debian in 9 easy steps

working great in my end.. nice share and great tut...

2011-11-21T13:10:45.707Z

working great in my end.. nice share and great tutorial :)

Got it running. I had trailing / after my chroot a...

2011-09-21T15:01:11.015Z

Got it running. I had trailing / after my chroot and chmod commands.

I keep getting the error "fatal: bad ownersh...

2011-09-21T14:49:15.233Z

I keep getting the error "fatal: bad ownership or modes for chroot directory "/home/user"" in my /var/log/auth.log, after following the guide.
Both throught sftp and ssh access.
I have closed the Match as mentioned above.

Hey! thanks for the great tutorial! However I had ...

2011-06-22T16:02:29.124+01:00

Hey! thanks for the great tutorial!
However I had problems to get it running, until I found out that you actually need to close the Match clause. Otherwise in my case no sftp connections were possible. So a corrected sshd.conf should look like this:

Match group sftponly
ChrootDirectory /home/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
Match

hope this helps!

thank you very much. great post. worked like a cha...

2011-06-12T12:15:56.405+01:00

thank you very much. great post. worked like a charm for my ubuntu 10 in MS virtual PC

Didnt work for me. login in with sftp://localhost ...

2011-02-23T21:43:05.029Z

Didnt work for me. login in with sftp://localhost refuses user

Both SSH and FTP are running and user and usergroup are active

You can let users upload files by creating a new d...

2011-01-19T21:37:25.044Z

You can let users upload files by creating a new directory in the jail and set the owner of the directory to the user.

I'm too want to know

2011-01-11T17:29:02.835Z

I'm too want to know

I would also like to know how to safely enable rea...

2010-11-19T02:46:20.328Z

I would also like to know how to safely enable read/write access without introducing other issues.

Hi, I followed these to the letter and the user di...

2010-11-15T22:12:02.229Z

Hi, I followed these to the letter and the user directories are not writeable. How do I allow users to upload files?
thanks

After that steps users from sftponly are able to n...

2010-08-10T08:32:55.955Z

After that steps users from sftponly are able to navigate between all directories on my server. How to disable it?

This is a great article. For a little clarificatio...

2010-07-07T09:00:39.915+01:00

This is a great article. For a little clarification on what happens in which order, I found this was also helpful:

http://binblog.info/2008/04/06/openssh-chrooted-sftp-eg-for-webhosting/

I need multiple users to access the same directory (as per previous comment) using keys. To do this, I create each user with adduser and set them in the sftponly group with addgroup. I then create a shared jail as /var/sftp, and ensured root.root owned it with 755 perms (chown and chmod)- all the same as in the article.

Each user makes a private/public key-pair (e.g. with ssh-keygen) and give me the public key, which I add manually add to their pre-chroot /home/username/.ssh/authorized_keys (which must be owned by and writable only by that user).

Since authentication happens *before* the chroot, each user's /home/username/.ssh/authorized_keys is used. But since the user's home directory is evaluated *post* chroot, we've changed it to / (as per article), and so the default sshd AuthorizedKeysFile of $HOME/.ssh/authorized_keys no longer works, and must be changed to explicitly depend upon the user name.

The final /etc/ssh/sshd_config file looks like this (don't forget to restart ssh!):

AuthorizedKeysFile /home/%u/.ssh/authorized_keys

## directions from
## http://blog.markvdb.be/2009/01/sftp-on-ubuntu-and-debian-in-9-easy.html
Match group sftponly
ChrootDirectory /var/sftp
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

I want to change the home directory for all users ...

2010-05-10T22:36:58.107+01:00

I want to change the home directory for all users to /Public just as a test. However after following these steps to change the home directory for user "peter" to / I am unable to use usermod -d to change the directory that I start in when I use a client such as WinSCP to my user. Instead, I always directly start at "/"

How do I fix this?

I think I got it, it's not pretty but it shoul...

2010-02-08T13:25:31.585Z

I think I got it, it's not pretty but it should work:

1) Uncomment this line:
#AuthorizedKeysFile %h/.ssh/authorized_keys
And change it to:
AuthorizedKeysFile /home/%u/.ssh/authorized_keys

2) Create a 'jail' directory in each users chroot directory, e.g.
mkdir /home/henk/jail

3) Change ChrootDirectory /home/%u to
ChrootDirectory /home/%u/jail

4) Create a '.ssh' directory besides the jail directory for each user that uses public key auth

5) Place the authorized_keys file in the home directories and change ownership to that given user, e.g.:
chown henk:henk /home/henk/.ssh/authorized_keys

6) If the file doesn't have the right permissions already, change it now:
chmod 600 /home/henk/.ssh/authorized_keys

Also, if you want to provide access to a certain directory ( inside the 'jail' directory), e.g. /var/www/henk.nl, try this:

chown henk:henk /var/www/henk.nl #(to permit access if not already so)
mkdir /home/henk/jail/henk.nl
mount -o bind,nodev,nosuid,noexec /var/www/henk.nl /home/henk/jail/henk.nl

Before the mount, the mount target should be owned by root. After the mount, that directory will be owned by whoever owns the other directory, in fact everything will be exactly the same. This also adds security because /var is probably not mounted with nodev,nosuid,noexec.

This doesn't work with public key auth, becaus...

2010-02-08T12:53:31.713Z

This doesn't work with public key auth, because sshd requires the .ssh/authorized_keys file to be owned by the user logging in. Thus you can only let 1 user in. Is there a workaround for this?

Am I supposed to create a new account to replace &...

2009-11-16T22:58:07.909Z

Am I supposed to create a new account to replace 'peter' or use an existing one. I really don't like the idea of shifting my entire home directory around!

any reason why enabling write access with: chmod ...

2009-11-10T09:43:11.723Z

any reason why enabling write access with:

chmod 775 /home/(username)
chown root.sftponly /home/(username)

is bad?

(Just installed it for apache2 uploads. Seems to work.)

I think the reason / is used as the ChrootDirector...

2009-07-09T16:05:05.251+01:00

I think the reason / is used as the ChrootDirectory, is because the home directory for the sftp user and all previous directories in the hierarchy must be owned by root, and only writeable by root. For instance if you want the user to be chrooted to /var/upload, you have to make sure /var/upload, /var and / are owned by root, and only writeable by root (chmod 755). Once the user logs in, since their home directory is owned by root they will not be able to upload files/create directories. Create a folder structure for them, chown the folder(s) to the sftp user, and they can then upload files.

Source: http://www.minstrel.org.uk/papers/sftp/builtin/

After i first read some howto involving rssh i di...

2009-05-11T16:15:00.000Z

After i first read some howto involving rssh i discovered your howto.

worked perfectly!

i just made a slight change
ChrootDirectory ~

this prevented me from resetting permissions and stuff so i could just use whatever homedir i want.

or is there a reason for doing it the way you described?

Thx Marc, exactly what I needed. :)

2009-05-05T18:45:00.000Z

Thx Marc, exactly what I needed.
:)

Why if I skip step 7 the user cannot login? It se...

2009-03-04T22:29:00.000Z

Why if I skip step 7 the user cannot login? It seems the only way to allow the user to upload is to create a subdirectory as root then chown it to the user. Is there a better way?

Also for step 7, wouldn't "chown root:root /home/peter" be better? Or does it even matter?

BTW, thanks very much for the directions, this is just what I was looking for.

Sorry I forgot to restart ssh.

sudo /etc/in...

2009-02-19T13:57:00.000Z

Sorry I forgot to restart ssh.

sudo /etc/init.d/ssh restart

I did get an error on ubuntu 8.10 that said TcpForwarding was not allowed and once removed it worked fine.

when using filezilla to connect I can still browse...

2009-02-19T13:27:00.000Z

when using filezilla to connect I can still browse and navigate the system, I would like to locked this to only their home directory. Allowing for them to see files, download and upload files only.

If anyone wants it, I have backported the OpenSSH ...

2009-01-10T22:55:00.000Z

If anyone wants it, I have backported the OpenSSH version from Intrepid for Hardy in my PPA: https://launchpad.net/~rainct/+archive

[DISCLAIMER: All files there come with NO support from Canonical nor Ubuntu, and only limited maintenance from me. Use them at your own responsibility.]

Ah, I see version 5.0 of OpenSSH is required. Too ...

2009-01-09T23:32:00.000Z

Ah, I see version 5.0 of OpenSSH is required. Too bad.

Comments on Mark Van den Borre: SFTP on Ubuntu and Debian in 9 easy steps

working great in my end.. nice share and great tut...

Got it running. I had trailing / after my chroot a...

I keep getting the error "fatal: bad ownersh...

Hey! thanks for the great tutorial! However I had ...

thank you very much. great post. worked like a cha...

Didnt work for me. login in with sftp://localhost ...

You can let users upload files by creating a new d...

I'm too want to know

I would also like to know how to safely enable rea...

Hi, I followed these to the letter and the user di...

After that steps users from sftponly are able to n...

This is a great article. For a little clarificatio...

I want to change the home directory for all users ...

I think I got it, it's not pretty but it shoul...

This doesn't work with public key auth, becaus...

Am I supposed to create a new account to replace &...

any reason why enabling write access with: chmod ...

I think the reason / is used as the ChrootDirector...

After i first read some howto involving rssh i di...

Thx Marc, exactly what I needed. :)

Why if I skip step 7 the user cannot login? It se...

Sorry I forgot to restart ssh.sudo /etc/in...

when using filezilla to connect I can still browse...

If anyone wants it, I have backported the OpenSSH ...

Ah, I see version 5.0 of OpenSSH is required. Too ...

Sorry I forgot to restart ssh.

sudo /etc/in...