Linux Settings sftp service user directory permissions

We sometimes encounter the need to restrict a Linux user to add, modify, delete only in the specified directory, and only use SFTP to log on to the server, not SSH operation. These can be implemented by configuring the SFTP service.

There are vsftpd and internal-sftp for the SFTP service, the system comes with the INTERNAL-SFTP, the following steps:

1. Create new user UI, disable SSH login, do not create home directory

Useradd-s/sbin/nologin-m www

2. Set User password

passwd www

3. Create the user's root directory, the user can only be active in this directory

mkdir /home/www

4. Set directory permissions, there are two key points for directory permissions:
Directory owners who start the directory up to the root of the system can only be root
The directory starts to go up to the system root and cannot have group write permissions

chown root:root/home/wwwchmod 755/home/www

5. Configure Sshd_config

Vim/etc/ssh/sshd_config

6. Change to the following, save exit

#comment out this line#Subsystem Sftp/usr/libexec/openssh/sftp-server#add at the end of the configuration fileSubsystem sftp internal-sftp#Specifies that the system comes with the INTERNAL-SFTP using the SFTP serviceMatch User www#match users, if you want to match multiple groups, separate multiple groups with commasChrootdirectory/home/www#with chroot will specify the user's root directory, meaning of chroot: http://www.ibm.com/developerworks/cn/linux/l-cn-chroot/Forcecommand internal-sftp#Specify the SFTP commandX11forwarding No#These two lines, if you do not want the user to be able to use port forwarding, add, otherwise deleteAllowtcpforwarding No

7. Restart the SSHD service

Service sshd Restart

8. Test:
After the user logs in is/home/www the user root directory, the root directory is unable to write, so first use root in/home/www to create a new UI directory

mkdir /home/www/ui

Modify Directory Owners and permissions

chown ui:ui/home/www/UIchmod 777/home/www/UI# can create a soft connection in another directory point to the UI directory  #ln-s  /home/www/ui/www/

SFTP Login www User, enter the UI directory, you can add, modify, delete the file under/home/www/ui

sftp-oport=22 [email protected]SFTP> CD UI

Linux Settings sftp service user directory permissions