SFTP jailing in RHEL

SFTP jailing in RHEL

Requirement: Users need only sftp access  and they should be limited to their home directory.

Solution : Chrooted SFTP environment  with disallowing ftp access.

I used RHEL 6.2 Operating System  for  testing

Let the user be suresh .

Create a group; let it be sftponly.

èAdd the group

# groupadd  sftponly

èAdd the users with sftponly group membership.

# useradd -g sftponly -M -d /homedir -s /bin/false suesh  

-M option will help to not create the directory while adding the user. Non-existent shell prevent from interactive logins(SSH/telnet/rsh/rlogin etc)

# passwd suresh

èNow edit SSH server configuration file and comment the default Subsystem entry for sftp and add  “Subsystem                sftp        internal-sftp”  . Append Match block also.

# vi /etc/ssh/sshd_config

#Subsystem       sftp        /usr/libexec/openssh/sftp-server

Subsystem          sftp        internal-sftp

Match Group sftponly                                         

ChrootDirectory /chroots/%u          

AllowTcpForwarding no

ForceCommand       internal-sftp             

X11Forwarding no                                          

Match block matches the group sftponly and applies  below settings to  its members alone.

%u  stands for user_name  ; chrooted directory becomes /chroots/suresh   for  user suresh.

èCreate the directories and set sufficient permissions. 

# mkdir -p /chroots/suresh;chmod 755 /chroots/suresh

# mkdir /chroots/suresh/homedir
# chown suresh:sftponly /chroots/suresh/homedir

To secure from other users reading /chroots/suresh/homedir  contents.

# chmod 750 /chroots/suresh/homedir          

èNow restart SSH service.

# service sshd restart

To block ftp access …add the user name to /etc/vsftpd/ftpusers.

Now suresh has only sftp access (no ssh/telnet/rlogin/rsh/scp/ftp……) and his visibility is limited to /homedir only. For suresh   “/chroots/suresh” becomes the root directory ,ie; “/”. So this kind of setup is pretty secure.