SFTP user chrooted to wwwroot subfolder (Nginx): Difference between revisions

The common place for all users' authorized_keys files will be in /usr/share/sshkeys:

Then we change the sshd config to look here for the public keys:

Find and edit this line (create if doesn't exist):

Move all users' authorized_keys here. There is no way around this. And this must be done in the future for each new user who will want to use key authentication:

Repeat the above for all users with SSH key-based access, also copy here a public key of our new SFTP user (lets call him sftpuser)

Set the permissions (or check them) and create a symlink back to the /home/someuser/.ssh (for all users):

If you already have the SFTP home folder created, do it for the SFTP user as well, if not, ignore the following 3 lines:

Once happy, restart the sshd to apply the changes:

Then, add the user. He will need to be in the nginx group (usually www-data) and his home folder will be set to the desired site subfolder:

The /usr/bin/nologin shell is there because we don't want the user to be able to log in via SSH

The www-data user also needs to be added to the sftpuser's group:

Edit the /etc/ssh/sshd_config file again to add chroot:

Add (or uncomment) the sftp paragraph:

This way the user will only have access to his 'home' folder, seeing it as a root folder.

First, make sure the permissions on your site folder, subfolders and files are set correctly (particularly Magento can have problems here). Then start changing the permissions:

The above command is to determine the current permissions of the sftp(sub)folder. Record the owner(u) and the others'(o) permissions. Why? Remember, it's not just the sftpuser in the www-data group but vice versa. This way we  

will have his home folder but make sure the www-data account (which Nginx is running under) will have still the same permissions.

In the next command make sure the owner(u) and the group permissions(g) are the same, the (o) permissions can stay as they were:

And change the owner and permissions to comply with the sshd chroot conditions:

Note the missing -R parameter when we are changing the parent folders' owner and permissions. We don't want to mess up the permissions on the content of these folders, just the folders themselves.

Now create the .ssh folder and link the already created public key there (if you didn't do it yet):

Once you've double-checked that all permissions are as they should be, apply the sshd_config changes: