Here is how to set up a secured SFTP server where the user is not permitted shell access, nor access to any other part of the filesystem than what you allow with the chroot. I did this in September 2012 on Ubuntu 12.04.<\/p>\n
First, I want to create a place for all the files to live:<\/p>\n
OpenSSH requires that the sftp user cannot have write access to the root directory, so you have to create at least one sub directory that can be owned by the sftp user:<\/p>\n Second, we want to add a new user solely for this server:<\/p>\n Change their password to something long and strong:<\/p>\n Give them control over the incoming directory so they can deposit files there:<\/p>\n Third, we need to enable SFTP in the SSHD configuration. Edit the file \/etc\/ssh\/sshd_config and change the sftp line to this:<\/p>\n Then add this chunk to the end of the file (make sure to put it after the “UsePAM” line!) :<\/p>\n Restart the SSH server with “sudo service ssh restart” and then you should be all set to go!<\/p>\n","protected":false},"excerpt":{"rendered":" Here is how to set up a secured SFTP server where the user is not permitted shell access, nor access to any other part of the filesystem than what you allow with the chroot. I did this in September 2012 on Ubuntu 12.04. First, I want to create a place for all the files to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1],"tags":[29,10,28,27,26,25],"class_list":["post-44","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-computers","tag-linux","tag-server","tag-sftp","tag-ssh","tag-unix-sysadmin"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p2BznB-I","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.mbeckler.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/44","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mbeckler.org\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mbeckler.org\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mbeckler.org\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mbeckler.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=44"}],"version-history":[{"count":7,"href":"https:\/\/www.mbeckler.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/44\/revisions"}],"predecessor-version":[{"id":62,"href":"https:\/\/www.mbeckler.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/44\/revisions\/62"}],"wp:attachment":[{"href":"https:\/\/www.mbeckler.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=44"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mbeckler.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=44"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mbeckler.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=44"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}sudo mkdir \/data\/<\/code><\/p>\nsudo mkdir \/data\/incoming\/<\/code><\/p>\nsudo useradd --home-dir \/data\/incoming --no-create-home sftpuser<\/code><\/p>\nsudo passwd sftpupser<\/code><\/p>\nsudo chown sftpuser:sftpuser \/data\/incoming\/<\/code><\/p>\nSubsystem sftp internal-sftp<\/code><\/p>\nMatch User sftpuser
\n ChrootDirectory \/data
\n AllowTCPForwarding no
\n X11Forwarding no
\n ForceCommand internal-sftp<\/code><\/p>\n