Sftp - Revision history

Christoph at 11:40, 20 September 2014

2014-09-20T11:40:46Z

Christoph at 11:40, 20 September 2014

2014-09-20T11:40:04Z

Christoph: New page: '''SSH File Transfer Protocol''' (also '''Secure File Transfer Protocol'' or '''SFTP'') is a network protocol that provides file access, file transfer, and file management functionalities ...

2014-09-20T11:39:48Z

New page: '''SSH File Transfer Protocol''' (also '''Secure File Transfer Protocol'' or '''SFTP'') is a network protocol that provides file access, file transfer, and file management functionalities ...

New page

'''SSH File Transfer Protocol''' (also '''Secure File Transfer Protocol'' or '''SFTP'') is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream. It is an extension of the [[SSH|Secure Shell protocol]] (SSH) version 2.0 to provide secure file transfer capability, but is also intended to be usable with other protocols.

==SFTP chroot jail==

A "<code>chroot</code>" in [[Linux]] is an operation that changes the apparent root directory for the current running process and its children. A program that is run in such a modified environment cannot name (and therefore normally not access) files outside the designated directory tree. The term "chroot" may refer to the <code>chroot(2)</code> system call or the <code>chroot(8)</code> wrapper program. The following is how one would setup a modified environment (a "chroot jail") for a given directory that only allows a given user to access a specified directory (and only that directory, no other on the system).

''NOTE: In the following example, there will be a user "<code>bob</code>" who only has access to upload/download files from the <code>/var/www/jail/bob</code> directory.''

* Step#1: Add the following to the bottom of your <code>/etc/ssh/sshd_config</code> file

Match user bob
ChrootDirectory /var/www/jail/%u

Then,
$ sudo service ssh restart

* Step #2: Run the following commands (as root/sudo):

$ mkdir -p /var/www/jail/bob
$ addgroup --system sftp-users
$ useradd -m -s /bin/nologin -c "bob" -G sftp-users bob
$ passwd bob # set password for user "bob"
$ chown root:root /home/
$ chown root:root /home/bob/
$ chmod 755 /home/bob
$ mkdir -p /home/bob/data
$ chown -Rv bob:sftp-users data
$ chown -Rv bob:sftp-users /var/www/jail/bob/
$ mount --bind /var/www/jail/bob/ /home/bob/data/
$ cat /etc/mtab # check that the following line exists
/var/www/jail/bob /home/bob/data none rw,bind 0 0
$ cp /etc/fstab{,.bak} # backup your old fstab
$ tail -1 /etc/mtab >>/etc/fstab
$ echo "Testing bob's SFTP chroot jail" >/home/bob/data/README
$ chown root /var/www/jail/bob

* Step #3: Testing your setup (where "<code>x.x.x.x</code>" is the IP address of the remote server):

$ sftp bob@x.x.x.x
sftp> ls
README

If all goes as planned, user "bob" should be able to read/download the "<code>README</code>" file and upload files to that <code>/var/www/jail/bob/</code> directory (and that directory only).

==See also==
*[[SSH]]

[[Category:Linux Command Line Tools]]

← Older revision		Revision as of 11:40, 20 September 2014
Line 1:		Line 1:
−	'''SSH File Transfer Protocol''' (also '''Secure File Transfer Protocol''' or '''SFTP'') is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream. It is an extension of the [[SSH\|Secure Shell protocol]] (SSH) version 2.0 to provide secure file transfer capability, but is also intended to be usable with other protocols.	+	'''SSH File Transfer Protocol''' (also '''Secure File Transfer Protocol''' or '''SFTP''') is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream. It is an extension of the [[SSH\|Secure Shell protocol]] (SSH) version 2.0 to provide secure file transfer capability, but is also intended to be usable with other protocols.

	==SFTP chroot jail==		==SFTP chroot jail==

← Older revision		Revision as of 11:40, 20 September 2014
Line 1:		Line 1:
−	'''SSH File Transfer Protocol''' (also '''Secure File Transfer Protocol'' or '''SFTP'') is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream. It is an extension of the [[SSH\|Secure Shell protocol]] (SSH) version 2.0 to provide secure file transfer capability, but is also intended to be usable with other protocols.	+	'''SSH File Transfer Protocol''' (also '''Secure File Transfer Protocol''' or '''SFTP'') is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream. It is an extension of the [[SSH\|Secure Shell protocol]] (SSH) version 2.0 to provide secure file transfer capability, but is also intended to be usable with other protocols.

	==SFTP chroot jail==		==SFTP chroot jail==