SFTP only + Chroot

SFTP only + Chroot 2014/07/09

	Configure SFTP only + Chroot. Some users who are applied this settings can access only with SFTP and access to the permitted directories.
[1]	For example, Set /home as the Chroot directory.

# create a group for SFTP [root@dlp ~]#  groupadd sftp_users  # apply to a user "cent" for SFTP only [root@dlp ~]#  usermod -G sftp_users cent  [root@dlp ~]#  vi /etc/ssh/sshd_config # line 147: comment out and add a line like below # Subsystem sftp /usr/libexec/openssh/sftp-server Subsystem sftp internal-sftp # add follows to the end Match Group sftp_users   X11Forwarding no   AllowTcpForwarding no   ChrootDirectory /home   ForceCommand internal-sftp [root@dlp ~]#  systemctl restart sshd

[2]	Try to access with a user and make sure the settings.

[root@rx-7 ~]#  ssh cent@10.0.0.30  cent@10.0.0.30's password: This service allows sftp connections only. Connection to 10.0.0.30 closed. # denyed normally [root@rx-7 ~]#  sftp cent@10.0.0.30  Connecting to 10.0.0.30... cent@10.0.0.30's password: sftp>  ls -l drwx------ 3 1000 1000 4096 Jul 9 12:06 cent drwx------ 2 1001 1001 59 Jul 8 22:06 hirokun sftp>  pwd Remote working directory: / sftp>  exit