Linux Settings sftp service user directory permissions

Source: Internet
Author: User

We sometimes encounter the need to restrict a Linux user to add, modify, delete only in the specified directory, and only use SFTP to log on to the server, not SSH operation. These can be implemented by configuring the SFTP service.

There are vsftpd and internal-sftp for the SFTP service, the system comes with the INTERNAL-SFTP, the following steps:

1. Create new user UI, disable SSH login, do not create home directory

Useradd-s/sbin/nologin-m www

2. Set User password

passwd www

3. Create the user's root directory, the user can only be active in this directory

mkdir /home/www

4. Set directory permissions, there are two key points for directory permissions:
Directory owners who start the directory up to the root of the system can only be root
The directory starts to go up to the system root and cannot have group write permissions

chown root:root/home/wwwchmod 755/home/www

5. Configure Sshd_config

Vim/etc/ssh/sshd_config

6. Change to the following, save exit

#comment out this line#Subsystem Sftp/usr/libexec/openssh/sftp-server#add at the end of the configuration fileSubsystem sftp internal-sftp#Specifies that the system comes with the INTERNAL-SFTP using the SFTP serviceMatch User www#match users, if you want to match multiple groups, separate multiple groups with commasChrootdirectory/home/www#with chroot will specify the user's root directory, meaning of chroot: http://www.ibm.com/developerworks/cn/linux/l-cn-chroot/Forcecommand internal-sftp#Specify the SFTP commandX11forwarding No#These two lines, if you do not want the user to be able to use port forwarding, add, otherwise deleteAllowtcpforwarding No

7. Restart the SSHD service

Service sshd Restart

8. Test:
After the user logs in is/home/www the user root directory, the root directory is unable to write, so first use root in/home/www to create a new UI directory

mkdir /home/www/ui

Modify Directory Owners and permissions

chown ui:ui/home/www/UIchmod 777/home/www/UI# can create a soft connection in another directory point to the UI directory  #ln-s  /home/www/ui/www/

SFTP Login www User, enter the UI directory, you can add, modify, delete the file under/home/www/ui

sftp-oport=22 [email protected]SFTP> CD UI

Linux Settings sftp service user directory permissions

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.