Create a user who cannot ssh login sftpuser1, password for SFTP login:
sudo adduser sftpuser1--home/sftp/sftpuser1--shell/bin/false
Run command Edit file sudo vi/etc/ssh/sshd_config
On the subsystem Sftp/usr/lib/openssh/sftp-server modified to subsystem sftp INTERNAL-SFTP
and add:
subsystem SFTP INTERNAL-SFTP
Match User Sftpuser1
Chrootdirectory/sftp/sftpuser1
Forcecommand internal-sftp
Allowtcpforwarding No
X11forwarding No
Note the owner of the directory/sftp/sftpuser1 for the Chrootdirectory setting must be root and the parent of the directory/sftp must also be root.
And only the owner has write permission, the maximum permissions for/sftp/sftpuser1 and/sftp can only be 755.
sudo chown root:root/sftp/sftpuser1
sudo service ssh reload
Because the permissions on the directory above are 755,
Therefore, all non-root users are unable to write files in the directory.
We need to create subdirectories such as data in the directory specified by Chrootdirectory, and reset the owner and permissions.
Mkdir/sftp/sftpuser1/data
Chown Sftpuser1:sftpuser1/sftp/sftpuser1/data
chmod 755/sftp/sftpuser1/data
This allows you to read and write to the data directory.
Once configured, user sftpuser1 can only access the specified directory via SFTP and cannot ssh logon:
SFTP sftpuser1 @127.0.0.1 Login succeeded, execute Ls-lha/visible root directory for/sftp/sftpuser1, execute CD. Visible cannot go to the previous level directory.
SSH sftpuser1 @127.0.0.1 Hint:
Could not chdir to home directory/sftp/sftpuser1:no such file or directory
This service allows SFTP connections.
Connection to 127.0.0.1 closed.
Changing allowtcpforwarding No to allowtcpforwarding yes indicates that the user is allowed to port forwarding, x11forwarding meaning is similar.
The above has implemented port forwarding and prohibit login, if you want to prohibit read and write, execute chmod 000/sftp/sftpuser1