View source for Chrooting sftp users to home directory with openSSH

[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[OpenSSH server configuration]] > [[Chrooting sftp users to home directory with openSSH]]

In shared hosting environment it might be desired that users can only do sftp and cannot execute shell commands. Also it is desired that users cannot access any file outside their home directory. This can be achieved by chrooting users to their home directory. Creating a directory where 'chroot' would work is not easy task as lot of devices, files, etc. need to be in place for chroot to be successful. Hence we use internal-sftp server of openssh (version 4.9+) which can chroot without requiring any of these files. 

==Updating ssh on CentOS 6.x using source==

#Download latest openssh portable source code from http://www.openssh.org/portable.html  This is to ensure that ssh version in 4.9+. In case SSH version is already greater than 4.9 then compiling from source is not required. 
#Configure using '<tt>./configure --with-tcp-wrappers --with-pam --with-rand-helper --with-md5-passwords --prefix=/ --sysconfdir=/etc/ssh --sbindir=/usr/sbin --bindir=/usr/bin</tt>'
#:--with-audit and --with-selinux give problem during configure or make and hence should be avoided.
# <tt>make clean</tt>
# <tt>make</tt>
# <tt>rm /etc/ssh/*</tt> (since <tt>make install</tt> does not overwrite old files).
# <tt>make install</tt>


==Configuring sftp chroot for user/group==

#Edit file <tt>/etc/ssh/sshd_config</tt>
#:<pre>
#:: Port 22
#:: Protocol 2
#:: PermitRootLogin yes
#:: Subsystem sftp internal-sftp
#:: 
#:: Match Group sftponly
#::	ChrootDirectory %h
#::	ForceCommand internal-sftp
#::	AllowTcpForwarding no
#::	X11Forwarding no
#:</pre>
# <tt>service sshd restart</tt>
# <tt>useradd saurabh</tt>
# <tt>passwd saurabh</tt>
# <tt>groupadd sftponly</tt>
# <tt>usermod -g sftponly saurabh</tt>
# <tt>chown root:root /home/saurabh</tt>
# <tt>chmod 755 /home/saurabh</tt>
# <tt>mkdir /home/saurabh/public_html_secret </tt>
# <tt>mkdir /home/saurabh/private</tt>
#: Note that user wont be able to create files in his / her home directory as it is owned by root which is required for chroot. Hence we have to create first level of directories for user.
# <tt>chown saurabh:sftponly /home/saurabh/*</tt>
# <tt>chmod 700 /home/saurabh/private</tt>
# <tt>chmod 755 /home/saurabh/public_html</tt>

Note that after this only sftp, gftp, winscp, etc. will work. This does not allow rsync to work. To make rsync work we would have to setup proper chroot environment with device files, password files, binary files, libraries, etc.


One can test the setup by using both '<tt>ssh</tt>' and '<tt>sftp</tt>' commands for user saurabh on machine configured as explained above to ensure that only sftp is working. After connecting using '<tt>sftp</tt>' try '<tt>cd ..</tt>' or '<tt>cd /</tt>' to ensure that user can't get out of home directory.


Procedure has been learned from http://www.minstrel.org.uk/papers/sftp/builtin/


[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[OpenSSH server configuration]] > [[Chrooting sftp users to home directory with openSSH]]