SFTP only Login specified directory

Source: Internet
Author: User
Tags chmod

Create a user who cannot ssh login sftpuser1, password for SFTP login:
sudo adduser sftpuser1--home/sftp/sftpuser1--shell/bin/false
Run command Edit file sudo vi/etc/ssh/sshd_config
On the subsystem Sftp/usr/lib/openssh/sftp-server modified to subsystem sftp INTERNAL-SFTP

and add:

subsystem SFTP INTERNAL-SFTP
Match User Sftpuser1
Chrootdirectory/sftp/sftpuser1
Forcecommand internal-sftp
Allowtcpforwarding No
X11forwarding No
Note the owner of the directory/sftp/sftpuser1 for the Chrootdirectory setting must be root and the parent of the directory/sftp must also be root.


And only the owner has write permission, the maximum permissions for/sftp/sftpuser1 and/sftp can only be 755.
sudo chown root:root/sftp/sftpuser1
sudo service ssh reload

Because the permissions on the directory above are 755,
Therefore, all non-root users are unable to write files in the directory.


We need to create subdirectories such as data in the directory specified by Chrootdirectory, and reset the owner and permissions.
Mkdir/sftp/sftpuser1/data
Chown Sftpuser1:sftpuser1/sftp/sftpuser1/data
chmod 755/sftp/sftpuser1/data
This allows you to read and write to the data directory.


Once configured, user sftpuser1 can only access the specified directory via SFTP and cannot ssh logon:
SFTP sftpuser1 @127.0.0.1 Login succeeded, execute Ls-lha/visible root directory for/sftp/sftpuser1, execute CD. Visible cannot go to the previous level directory.
SSH sftpuser1 @127.0.0.1 Hint:
Could not chdir to home directory/sftp/sftpuser1:no such file or directory
This service allows SFTP connections.
Connection to 127.0.0.1 closed.


Changing allowtcpforwarding No to allowtcpforwarding yes indicates that the user is allowed to port forwarding, x11forwarding meaning is similar.
The above has implemented port forwarding and prohibit login, if you want to prohibit read and write, execute chmod 000/sftp/sftpuser1

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.