Create a SFTP user to access only one directory.

Question

I need to create a user which can only SFTP to specific directory and take a copy of some infomation. that is it. I keep looking online and they bring up information about chroot and modifying the the sshd_config.

So far I can just

• add the user "useradd sftpexport"
• create it without a home directory "-M"
• set its login location "-d /u02/export/cdrs" (Where the information is stored)
• not allow it to use ssh "-s /bin/false"

useradd sftpexport -M -d /u02/export/cdrs -s /bin/false

Can anyone suggest what am meant to edit so the user can only login and copy the file off?

Solution 1

I prefer to create a user group sftp and restrict users in that group to their home directory.

First, edit your /etc/ssh/sshd_config file and add this at the bottom.

Match Group sftp
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no  

This tells OpenSSH that all users in the sftp group are to be chrooted to their home directory (which %h represents in the ChrootDirectory command)

Add a new sftp group, add your user to the group, restrict him from ssh access and define his home directory.

groupadd sftp
usermod username -g sftp
usermod username -s /bin/false
usermod username -d /home/username

Restart ssh:

sudo service ssh restart

If you are still experiencing problems, check that the directory permissions are correct on the home directory. Adjust the 755 value appropriately for your setup.

sudo chmod 755 /home/username

EDIT: Based on the details of your question, it looks like you are just missing the sshd_config portion. In your case, substitute sftp with sftpexport. Also be sure that the file permissions are accessible on the /u02/export/cdrs directory.

An even better setup (and there are even better setups than what I am about to propose) is to symlink the /u02/export/cdrs directory to the user home directory.

Solution 2

You could need to add a restricted shell for this user can put some files there. You can use rssh tool for that.

usermod -s /usr/bin/rssh sftpexport

Enable allowed protocols in config /etc/rssh.conf.