Setup SFTP-only User Accounts on CentOS 7

<div dir="ltr" style="text-align: left;" trbidi="on"> <h1 style="box-sizing: border-box; font-family: Raleway, Helvetica, Arial, sans-serif; line-height: 46px; margin: 0px 0px 8px;"> <span style="color: #990000; font-size: large;"><u>Setup SFTP-only User Accounts on CentOS</u></span></h1> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">The SSH File Transfer Protocol (also Secure File Transfer Protocol, or SFTP) is a network protocol that provides file access, file transfer, and file management over any reliable data stream. It was designed by the Internet Engineering Task Force (IETF) as an extension of the Secure Shell protocol (<a href="http://www.hackthesec.co.in/search/label/SSH">SSH</a>) version 2.0 to provide secure file </span></span></div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0UoU738wfzIiGQcNwEh7rGJzNHBJmmJiBCvuVQpMOAdQltLab9w4pAzEuFpSuexA7trPxiLLFCLlTR2TJ-Iuw-Tz4zF2QdvvYDZr5vwxR2dW0WcSbp6qnjOAC6quoc-tRpzxf6KI3tkgX/s1600/sftp-software-hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0UoU738wfzIiGQcNwEh7rGJzNHBJmmJiBCvuVQpMOAdQltLab9w4pAzEuFpSuexA7trPxiLLFCLlTR2TJ-Iuw-Tz4zF2QdvvYDZr5vwxR2dW0WcSbp6qnjOAC6quoc-tRpzxf6KI3tkgX/s1600/sftp-software-hackthesec.co.in.jpg" /></a></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">transfer capabilities. The IETF Internet Draft states that, even though this protocol is described in the context of the SSH-2 protocol, it could be used in a number of different applications, such as secure file transfer over Transport Layer Security (TLS) and transfer of management information in <a href="http://www.hackthesec.co.in/search/label/VPN">VPN </a>applications.</span></span></div> <div> <span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Step 1: Create a dedicated sFTP group and a dedicated sFTP user</u></b></span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: white;">groupadd sftpusers </span><span style="color: orange;">useradd -G sftpusers -s /sbin/nologin user1 </span><span style="color: white;">passwd user1</span></span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Here, the group <b>sftpusers </b>is a dedicated sFTP group, the user <b>user1 </b>is a dedicated sFTP user which is forbidden to log in using SSH.</span></span></div> <div> <span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Step 2: Modify the configuration of the sshd service</u></b></span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Open the configuration file of the sshd service:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: large;"><span style="line-height: 20.8px;">vi /etc/ssh/sshd_config</span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Find the line:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: orange; font-size: large;"><span style="line-height: 20.8px;">Subsystem sftp /usr/libexec/openssh/sftp-server</span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Replace it with:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: white;">Subsystem </span><span style="color: orange;">sftp internal-sftp</span></span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Append the following lines to the end of the file. The group name <b>sftpusers </b>should be the same as the one you specified earlier.</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: white;">Match Group sftpusers X11Forwarding no AllowTcpForwarding no </span><span style="color: orange;">ChrootDirectory %h </span><span style="color: white;">ForceCommand internal-sftp</span></span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Save and quit: use :wq</span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Restart the sshd service to put your changes into effect.</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: white;">systemctl </span><span style="color: orange;">restart sshd.service</span></span></span></pre> </div> <div> <div style="font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> <b><u><span style="color: #0b5394;">Step 3: Create a dedicated directory for the sFTP-only user</span></u></b></div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> You need to specify a directory for the sFTP-only user and make sure that this user can only play around in this directory:</div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: white;">chown -R root /home/user1 chmod -R 755 /home/user1 </span><span style="color: orange;">mkdir /home/user1/files </span><span style="color: white;">chown user1. /home/user1/files</span></span></span></pre> </div> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Now, the user <b>user1 </b>can only upload and/or download files in the directory <b>/home/user1/files</b>, he or she can never touch other users' files.</span></span></div> <div> <span style="font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><div> <b><u><span style="color: #0b5394;">Step 4: Create more sFTP-only users</span></u></b></div> <div style="color: #333333;"> If you need more sFTP-only users, you can create them in the same fashion:</div> </span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: orange;">useradd -G sftpusers -s /sbin/nologin user2 passwd user2</span><span style="color: white;"> chown -R root /home/user2 chmod -R 755 /home/user2 mkdir /home/user2/files chown user2. /home/user2/files</span></span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">That's it. Each user account created in this fashion will be denied if you use it to log in the system. These user accounts can be used only in sFTP programs.</span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></span></div> </div>

Setup SFTP-only User Accounts on CentOS 7

Setup SFTP-only User Accounts on CentOS The SSH File Transfer Protocol (also Secure File Transfer Protocol, or SFTP) is a network protoc...

Read more »

How to Install ProFTPD on CentOS 7

<div dir="ltr" style="text-align: left;" trbidi="on"> <h1 class="entry-title" style="background-color: white; border: 0px; box-sizing: inherit; font-family: proxima-nova, sans-serif; line-height: 3.4rem; margin: 0px; outline: 0px; padding: 0px; text-align: center; vertical-align: baseline;"> <span style="color: red; font-size: large;"><u>Install ProFTPD on CentOS 7</u></span></h1> <div> <b style="background-color: white; color: #222222; font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;">ProFTPD </b><span style="background-color: white; color: #222222; font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;">(short for Pro FTP daemon) is an </span><a href="http://www.hackthesec.co.in/search/label/ftp">FTP server</a><span style="background-color: white; color: #222222; font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;">. ProFTPD is Free and open-source software, compatible with Unix-like systems and Microsoft Windows (via Cygwin). Along with </span><a href="http://www.hackthesec.co.in/search/label/vsftp" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px; text-decoration: none;">vsftpd</a><span style="background-color: white; color: #222222; font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;"> and Pure-FTPd, ProFTPD is among the most popular FTP servers in </span></div> <div style="text-align: center;"> <img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhr45fLBm5B3qr3E_CEJ5KuZUrSdFkVs80KSv10Df6qJ6nUOVi87vnMY5LJDD7YL9QuqqK26UAfgpgxrqSMKsHMQ-kx54qElbc6d-6Iwn75dk9isdDXrxkmkjMepG2ZgBtZ80wDXGTqTLCY/s1600/proftpd-www.hackthesec.co.in.png" /></div> <div> <span style="background-color: white; color: #222222; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;"><span style="font-size: 15px; line-height: 26px;">Unix-like environments today. Compared to those, which focus e.g. on simplicity, speed or security, ProFTPD's primary design goal is to be a highly feature rich FTP server, exposing a large amount of configuration options to the user</span></span><span style="background-color: white; color: #222222; font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;">.</span></div> <div> <span style="background-color: white;"><div style="font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;"> <b><u><span style="color: #0b5394;">Step 1: Add the EPEL Repository</span></u></b></div> <div style="color: #222222; font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;"> ProFTPD is part of Extra Packages for Enterprise Linux (<a href="http://www.hackthesec.co.in/search/label/EPEL">EPEL</a>), which is a community repository of non-standard packages for the <a href="http://www.hackthesec.co.in/search/label/EPEL">RHEL</a> distribution. First, we’ll install the EPEL repository:</div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Trebuchet MS, sans-serif;"><span style="line-height: 15.6px;">rpm -iUvh http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm</span></span></pre> </div> <div style="font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;"> <div> <b><u><span style="color: #0b5394;">Step 2: Install ProFTPD</span></u></b></div> <div style="color: #222222;"> As a matter of best practice we’ll update our packages:</div> </div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Trebuchet MS, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">yum -y update</span></span></pre> </div> <div> <span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Then let’s install ProFTPD and any required packages:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Trebuchet MS, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">yum -y install proftpd</span></span></pre> </div> <div> <div> <span style="color: #0b5394; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Step 3: Configure ProFTPD</u></b></span></span></div> <div> <span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Let’s edit the configuration file for ProFTPD:</span></span></div> </div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Trebuchet MS, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">vi /etc/proftpd.conf</span></span></pre> </div> <div> <div> <div style="color: #222222; font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;"> Change the <b>ServerName to the hostname of your server</b>. In the case below, ftp.hackthesec.co.in is an example:</div> <div style="color: #222222; font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;"> <br /></div> <div style="color: #222222; font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;"> <b>ServerName </b>"ftp.hackthesec.co.in"</div> </div> <div> <span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div> <div> <span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Exit and save the file with the command :wq .</span></span></div> <div> <span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div> <div> <span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Restart the ProFTPD service:</u></b></span></span></div> </div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Trebuchet MS, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">systemctl restart proftpd</span></span></pre> </div> <div> <span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Then set the ProFTPD service to start at boot:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Trebuchet MS, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">systemctl enable proftpd</span></span></pre> </div> <div> <span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">And verify your work by checking the status of ProFTPD:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Trebuchet MS, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">systemctl status proftpd</span></span></pre> </div> <div style="font-family: Verdana, Geneva, sans-serif; font-size: 15px; line-height: 26px;"> <div> <b><u><span style="color: #0b5394;">Step 4: Allow ProFTPD Through the Firewall</span></u></b></div> <div style="color: #222222;"> Allow the default FTP port,<b> port 21</b>, through <b>firewalld</b>:</div> </div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Trebuchet MS, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">firewall-cmd --permanent --add-port=21/tcp</span></span></pre> </div> <div> <span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">And reload the firewall:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Trebuchet MS, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">firewall-cmd --reload</span></span></pre> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: red; font-family: Trebuchet MS, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a> <a href="http://facebook.com/htsecu">HackTheSec Facebook</a> <a href="https://www.twitter.com/Hackthesecurity">HackTheSec Twitter</a> <a href="http://feeds.hackthesec.co.in/hackthesec">HackTheSec Feed</a></span></span></pre> </div> </span></div> </div>

How to Install ProFTPD on CentOS 7

Install ProFTPD on CentOS 7 ProFTPD  (short for Pro FTP daemon) is an  FTP server . ProFTPD is Free and open-source software, compatible...

Read more »