Skip to main content.

Filesharing with chrooted SFTP

2014-02-12

Live demo in BSD Now Episode 024 | Originally written by TJ for bsdnow.tv | Last updated: 2014/05/08

NOTE: the author/maintainer of the tutorial(s) is no longer with the show, so the information below may be outdated or incorrect.

So you've followed our SSH tutorial and now you're ready to hand out accounts to your friends, right? Well, there are times when you want to securely share files with them, but don't want them having shell access to your server. OpenSSH includes SFTP, the secure file transfer protocol, which provides both authentication and encryption. Normally, you need to give a user an SSH login for them to be able to transfer files via SFTP, but there’s also a useful option to disallow shell access and only let them transfer files. What's more, you can lock them to a certain directory so they can't browse your filesystem. This tutorial will show you how to do just that. I’m assuming you already have sshd configured and running.

Let's create a new user for them to use and edit the sshd_config file to chroot them.

# adduser

Username: gnub
Full name: Some Random GNUb
Uid (Leave empty for default):
Login group [gnub]:
Login group is gnub. Invite gnub into other groups? []:
Login class [default]:
Shell (sh csh tcsh bash rbash nologin) [sh]: nologin
Home directory [/home/gnub]:
Home directory permissions (Leave empty for default):
Use password-based authentication? [yes]:
Use an empty password? (yes/no) [no]:
Use a random password? (yes/no) [no]:
Enter password:
Enter password again:
Lock out the account after creation? [no]:
Username   : gnub
Password   : *****
Full Name  : Some Random GNUb
Uid     : 1004
Class     :
Groups   : gnub
Home       : /home/gnub
Home Mode  :
Shell     : /usr/sbin/nologin
Locked   : no
OK? (yes/no): yes
adduser: INFO: Successfully added (gnub) to the user database.
Add another user? (yes/no): no
Goodbye!

Take note of the "nologin" shell - that's not the default. Next we edit the SSH configuration:

# vi /etc/ssh/sshd_config

Add something like this to the bottom:

Match User gnub
    PasswordAuthentication yes
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no
    AllowAgentForwarding no
    PermitTunnel no
    PermitTTY no
    X11Forwarding no

Restart the daemon.

# /etc/rc.d/sshd restart

Next, we set some permissions and make a directory for them to actually put files in.

# chown root:gnub /home/gnub
# mkdir /home/gnub/files
# chown gnub:gnub /home/gnub/files

Now you can give your friend the SFTP login and they will be locked in the home directory, but able to upload and download things to and from the "files" directory. If they try to login via SSH to get a shell, they should get the error:

This service allows sftp connections only.

Too bad for them.

Latest News

Two Year Anniversary

2015-08-08

We're quickly approaching our two-year anniversary, which will be on episode 105. To celebrate, we've created a unique t-shirt design, available for purchase until the end of August. Shirts will be shipped out around September 1st. Most of the proceeds will support the show, and specifically allow us to buy...

New discussion segment

2015-01-17

We're thinking about adding a new segment to the show where we discuss a topic that the listeners suggest. It's meant to be informative like a tutorial, but more of a "free discussion" format. If you have any subjects you want us to explore, or even just a good name...

How did you get into BSD?

2014-11-26

We've got a fun idea for the holidays this year: just like we ask during the interviews, we want to hear how all the viewers and listeners first got into BSD. Email us your story, either written or a video version, and we'll read and play some of them for...

EuroBSDCon 2014

2014-09-18

As you might expect, both Allan and Kris will be at EuroBSDCon this year. They'll be busy hunting down various BSD developers and forcing them to do interviews, but don't hesitate to say hi if you're a listener!...


Episode 104: Beverly Hills 25519

2015-08-26

Direct Download: Video | HD Video | MP3 Audio | OGG Audio | Torrent This episode was brought to you by Headlines EdgeRouter Lite, meet OpenBSD The ERL, much like the Raspberry Pi and a bunch of other cheap boards, is getting more and more popular as more things get ported to run on it...

Episode 103: Ubuntu Slaughters Kittens

2015-08-19

Direct Download: Video | HD Video | MP3 Audio | OGG Audio | Torrent This episode was brought to you by Interview - Bryan Cantrill - bryan@joyent.com / @bcantrill BSD and Solaris history, illumos, dtrace, Joyent, pkgsrc, various topics (and rants) Feedback/Questions Randy writes in Jared writes in Steve writes in Send questions, comments, show ideas/topics, or stories you...

Episode 102: May Contain ZFS

2015-08-12

Direct Download: Video | HD Video | MP3 Audio | OGG Audio | Torrent | YouTube This episode was brought to you by Headlines FreeBSD on Olimex RT5350F-OLinuXino If you haven't heard of the RT5350F-OLinuXino-EVB, you're not alone (actually, we probably couldn't even remember the name if we did know about it) It's a small board...

Episode 101: I'll Fix Everything

2015-08-05

Direct Download: Video | HD Video | MP3 Audio | OGG Audio | Torrent This episode was brought to you by Headlines OpenBSD, from distribution to project Ted Unangst has yet another interesting blog post up, this time covering a bit of BSD history and some different phases OpenBSD has been through It's the third part...