Linux Settings sftp service user directory permissions

We sometimes encounter the need to restrict a Linux user to add, modify, delete only in the specified directory, and only use SFTP to log on to the server, not SSH operation. These can be implemented by configuring the SFTP service.

There are vsftpd and internal-sftp for the SFTP service, the system comes with the INTERNAL-SFTP, the following steps:

1. Create new user UI, disable SSH login, do not create home directory

Useradd-s/sbin/nologin-m www

2. Set User password

passwd www

3. Create the user's root directory, the user can only be active in this directory

Mkdir/home/www

4. Set directory permissions, there are two key points for directory permissions:
Directory owners who start the directory up to the root of the system can only be root
The directory starts to go up to the system root and cannot have group write permissions

Chown Root:root/home/wwwchmod 755/home/www

5. Configure Sshd_config

Vim/etc/ssh/sshd_config

6. Change to the following, save exit

#注释掉这行 #subsystem      sftp    /usr/libexec/openssh/sftp-server# add Subsystem sftp internal-sftp # At the end of the configuration file     Specifies that the Internal-sftpmatch user www #匹配用户 using the system comes with the SFTP service                     , and if multiple groups are to be matched, separate the chrootdirectory/home/www with commas between the groups         # With chroot will specify the user's root directory, chroot meaning: Http://www.ibm.com/developerworks/cn/linux/l-cn-chroot/ForceCommand internal-sftp        #指定sftp命令X11Forwarding No                #这两行, if you do not want the user to be able to use port forwarding, add, otherwise delete allowtcpforwarding no

7. Restart the SSHD service

Service sshd Restart

8. Test:
After the user logs in is/home/www the user root directory, the root directory is unable to write, so first use root in/home/www to create a new UI directory

Mkdir/home/www/ui

Modify Directory Owners and permissions

Chown Ui:ui/home/www/uichmod 777/home/www/ui# can create a soft connection in other directories point to the UI directory #ln-s  /home/www/ui/www/

SFTP Login www User, enter the UI directory, you can add, modify, delete the file under/home/www/ui

sftp-oport=22 [email protected]sftp> CD UI

See MORE:

Develop a small program example tutorial

HTTP protocol Collation

PHP Security Web Attack

Second-kill system design optimization

MySQL optimization

Common IO models under Linux

Linux Settings sftp service user directory permissions