SFTP user Rights setting conditions and implementation commands under Linux _linux

It is well known that SFTP account is based on SSH account, so the access to the server by default is very large, today's tutorial is to teach you to SFTP user rights settings.

Necessary Conditions：
Your openssh-server version is at least 4.8P1, because configuring permissions requires a new configuration entry Chrootdirectory added to the version.
How do I view the version of SSH on my server? You can try the following command:
$ ssh-v
Specific implementation steps:
1. We need to create a user group dedicated to SFTP users
$ Groupadd Sftpusers
2. We create a user test
$ useradd-s/bin/false-g sftpuser test
Notice here we set the test user's shell to/bin/false so he doesn't have access to the shell.
3. Editor/etc/ssh/sshd_config
Find subsystem This configuration item and change it to
subsystem SFTP INTERNAL-SFTP
And then go to the end of the file. Add configuration settings users who belong to the user group Sftpusers only have access to their own home folder
Match Group Sftpusers
Chrootdirectory%h
Forcecommand internal-sftp
Allowtcpforwarding No
Save and close the file
4. Modify the permissions of the test user's home folder to belong to the root user
Chown Root ~test
5. Restart SSHD Service
$ Service sshd Restart
6. Test user Account
$ ssh Test@localhost
Connection will be rejected or cannot be logged in
$ sftp Tesst@localhost
After landing, you will find that your account cannot be switched to a location other than your own home directory.
Problems:
If you are linking to the server, the following prompts appear:
Write Failed:broken Pipe
Couldn ' t read packet:connection reset by peer
The reason for this problem is the Chrootdirectory permissions problem, the directory you set must be root users, otherwise there will be problems. So make sure the sftp user root is root and the permission is 750 or 755.