Linux Settings sftp service user directory permissions

Source: Internet
Author: User

We sometimes encounter the need to restrict a Linux user to add, modify, delete only in the specified directory, and only use SFTP to log on to the server, not SSH operation. These can be implemented by configuring the SFTP service.

There are vsftpd and internal-sftp for the SFTP service, the system comes with the INTERNAL-SFTP, the following steps:

1. Create new user UI, disable SSH login, do not create home directory

Useradd-s/sbin/nologin-m www

2. Set User password

passwd www

3. Create the user's root directory, the user can only be active in this directory

Mkdir/home/www

4. Set directory permissions, there are two key points for directory permissions:

Directory owners who start the directory up to the root of the system can only be root

The directory starts to go up to the system root and cannot have group write permissions

Chown Root:root/home/wwwchmod 755/home/www

5. Configure Sshd_config

Vim/etc/ssh/sshd_config

6. Change to the following, save exit

#注释掉这行 #subsystem      sftp    /usr/libexec/openssh/sftp-server# add Subsystem sftp internal-sftp # At the end of the configuration file     Specifies that the Internal-sftpmatch user www #匹配用户 using the system comes with the SFTP service, and if multiple groups are to be matched, separate the chrootdirectory/home/www with commas between the groups         # With chroot will specify the user's root directory, chroot meaning: Http://www.ibm.com/developerworks/cn/linux/l-cn-chroot/ForceCommand internal-sftp        #指定sftp命令X11Forwarding No #这两行, if you do not want the user to be able to use port forwarding, add, otherwise delete allowtcpforwarding no

7. Restart the SSHD service

Service sshd Restart

8. Test: The user login after entering the/home/www is the user root directory, the root directory is not writable, so first use root in/home/www to create a new UI directory

Mkdir/home/www/ui

Modify Directory Owners and permissions

Chown Ui:ui/home/www/uichmod 777/home/www/ui# can create a soft connection in other directories point to the UI directory #ln-s  /home/www/ui/www/

SFTP Login www User, enter the UI directory, you can add, modify, delete the file under/home/www/ui

sftp-oport=22 [email protected]sftp> CD UI

Linux Settings sftp service user directory permissions

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.