SFTP user Rights setting conditions and implementation commands under Linux _linux

Source: Internet
Author: User
Tags configuration settings connection reset ssh ssh account
It is well known that SFTP account is based on SSH account, so the access to the server by default is very large, today's tutorial is to teach you to SFTP user rights settings.

Necessary Conditions
Your openssh-server version is at least 4.8P1, because configuring permissions requires a new configuration entry Chrootdirectory added to the version.
How do I view the version of SSH on my server? You can try the following command:
$ ssh-v
Specific implementation steps:
1. We need to create a user group dedicated to SFTP users
$ Groupadd Sftpusers
2. We create a user test
$ useradd-s/bin/false-g sftpuser test
Notice here we set the test user's shell to/bin/false so he doesn't have access to the shell.
3. Editor/etc/ssh/sshd_config
Find subsystem This configuration item and change it to
subsystem SFTP INTERNAL-SFTP
And then go to the end of the file. Add configuration settings users who belong to the user group Sftpusers only have access to their own home folder
Match Group Sftpusers
Chrootdirectory%h
Forcecommand internal-sftp
Allowtcpforwarding No
Save and close the file
4. Modify the permissions of the test user's home folder to belong to the root user
Chown Root ~test
5. Restart SSHD Service
$ Service sshd Restart
6. Test user Account
$ ssh Test@localhost
Connection will be rejected or cannot be logged in
$ sftp Tesst@localhost
After landing, you will find that your account cannot be switched to a location other than your own home directory.
Problems:
If you are linking to the server, the following prompts appear:
Write Failed:broken Pipe
Couldn ' t read packet:connection reset by peer
The reason for this problem is the Chrootdirectory permissions problem, the directory you set must be root users, otherwise there will be problems. So make sure the sftp user root is root and the permission is 750 or 755.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.