SFTP user chrooted to wwwroot subfolder (Nginx)

2019-07-05T09:01:39Z

78.99.38.137: Created page with "First, we need to change the location of the public keys for users. Otherwise we will never set the user's home folder properly. The common place for all users' authorized_ke..."

First, we need to change the location of the public keys for users. Otherwise we will never set the user's home folder properly.

The common place for all users' authorized_keys files will be in /usr/share/sshkeys:
mkdir /usr/share/sshkeys

Then we change the sshd config to look here for the public keys:
vi /etc/ssh/sshd_config
Find and edit this line (create if doesn't exist):
AuthorizedKeysFile /usr/share/sshkeys/%u
Move all users' authorized_keys here. There is no way around this. And this must be done in the future for each new user who will want to use key authentication:
mv /home/someuser/.ssh/authorized_keys /usr/share/sshkeys/someuser
Repeat the above for all users with SSH key-based access, also copy here a public key of our new SFTP user (lets call him sftpuser)
Set the permissions (or check them) and create a symlink back to the /home/someuser/.ssh (for all users):
chown someuser /usr/share/sshkeys/someuser
chmod 600 /usr/share/sshkeys/someuser
ln -s /usr/share/sshkeys/someuser /home/someuser/.ssh/authorized_keys
If you already have the SFTP home folder created, do it for the SFTP user as well, if not, ignore the following 3 lines:
chown someuser /usr/share/sshkeys/sftpuser
chmod 600 /usr/share/sshkeys/sftpuser
ln -s /usr/share/sshkeys/sftpuser /var/www/siterootfolder/sftp(sub)folder/.ssh/authorized_keys
Once happy, restart the sshd to apply the changes:
systemctl restart sshd

Then, add the user. He will need to be in the nginx group (usually www-data) and his home folder will be set to the desired site subfolder:
useradd -m -d /var/www/siterootfolder/sftp(sub)folder/ -G www-data -s /usr/sbin/nologin sftpuser
The /usr/bin/nologin shell is there because we don't want the user to be able to log in via SSH
The www-data user also needs to be added to the sftpuser's group:
Usermod -a -G sftpuser www-data

Edit the /etc/ssh/sshd_config file again to add chroot:
vi /etc/ssh/sshd_config
Add (or uncomment) the sftp paragraph:
Match User sftpuser
ChrootDirectory /var/www/siterootfolder/sftp(sub)folder/
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
This way the user will only have access to his 'home' folder, seeing it as a root folder.

Unfortunately the sshd's internal sftp engine is very restrictive about folder permissions here. The chrooted folder, as well as its each parent (up to /) must be owned by root:root with permissions 755. To achieve this:
First, make sure the permissions on your site folder, subfolders and files are set correctly (particularly Magento can have problems here). Then start changing the permissions:
cd /
chown root:root var/
chmod 755 var/
cd var/
chown root:root www/
chmod 755 www/
cd www/
chown root:root siterootfolder/
chmod 755 siterootfolder/
cd siterootfolder/
ls -l
The above command is to determine the current permissions of the sftp(sub)folder. Record the owner(u) and the others'(o) permissions. Why? Remember, it's not just the sftpuser in the www-data group but vice versa. This way we will have his home folder but make sure the www-data account (which Nginx is running under) will have still the same permissions.
chown -R sftpuser:sftpuser sftp(sub)folder/
In the next command make sure the owner(u) and the group permissions(g) are the same, the (o) permissions can stay as they were:
chmod -R xxx sftp(sub)folder/
And change the owner and permissions to comply with the sshd chroot conditions:
chown root:root sftp(sub)folder/
chmod 755 sftp(sub)folder/
Note the missing -R parameter when we are changing the parent folders' owner and permissions. We don't want to mess up the permissions on the content of these folders, just the folders themselves.

Now create the .ssh folder and link the already created public key there (if you didn't do it yet):
cd sftp(sub)folder/
mkdir .ssh
chown -R sftpuser:sftpuser .ssh/
chmod -R 700 .ssh/
ln -s /usr/share/sshkeys/sftpuser /var/www/siterootfolder/sftp(sub)folder/.ssh/authorized_keys

Once you've double-checked that all permissions are as they should be, apply the sshd_config changes:
systemctl restart sshd

Complete step-by-step guides

2019-07-05T09:00:49Z

78.99.38.137: /* Please choose from the following */

<strong>Step-by-step guides.</strong>

== Please choose from the following ==
* [[Add new joinee]]
* [[Add new server]]
<nowiki>======================================</nowiki>
* [[Add new user to GitLab]]
* [[Add new server to GitLab AutoDeploy]]
* [[Convert the SVN repository to GitLab]]
* [[Installing ruby on rails with Nginx passenger]]
* [[Install Oracle client on Ubuntu]]
* [[Remove NewRelic agent]]
* [[Mysql Setup]]
* [[SFTP user chrooted to wwwroot subfolder (Nginx)]]

Apoyar Wiki - User contributions [en-gb]

SFTP user chrooted to wwwroot subfolder (Nginx)

Complete step-by-step guides