Chroot SFTP
1. Create the sftp init script – /etc/init.d/sftpfoo
Code:
#!/bin/bash
#
# chkconfig: 35 60 25
# description: OpenSSH chrooted sftp only daemon
#
# Note that /usr/sbin/sftpfoo is simply a symlink to /usr/sbin/sshd
#
pidfile='/var/run/sftpfoo.pid'
case "${1}" in
start ) exec -a /usr/sbin/sftpfoo /usr/sbin/sshd -f /etc/ssh/sftpfoo_config
;;
stop ) kill -9 $(cat ${pidfile})
;;
restart) stop
sleep 3
start
;;
* ) echo "Usage: ${0} (start|stop|restart)"
;;
esac
exit 0
2. Add it to chkconfig(8) consciousness and set up a symlink you’ll need later.
Code:
# chkconfig --add sftpfoo # ln -s /usr/sbin/sshd /usr/sbin/sftpfoo
3. Create your sftp config file – /etc/ssh/sftpfoo_config
Code:
Port 8822 Protocol 2 AddressFamily inet SyslogFacility AUTHPRIV LogLevel INFO PermitRootLogin no RSAAuthentication no PubkeyAuthentication no RhostsRSAAuthentication no HostbasedAuthentication no PasswordAuthentication yes PermitEmptyPasswords no ChallengeResponseAuthentication no KerberosAuthentication no GSSAPIAuthentication no UsePAM no PidFile /var/run/sftpfoo.pid ChrootDirectory /home/chrooted Subsystem sftp internal-sftp
4. Create your first sftp-only user
Code:
# useradd -d /nowhere -M -s /sbin/nologin baruser
5. Create the chroot directory
Code:
# mkdir -p /home/chrooted && chmod 755 /home/chrooted
6. Start the sftp service
Code:
# service sftpfoo start
0 comments