Setup SFTP-only User Accounts on CentOS 7

<div dir="ltr" style="text-align: left;" trbidi="on"> <h1 style="box-sizing: border-box; font-family: Raleway, Helvetica, Arial, sans-serif; line-height: 46px; margin: 0px 0px 8px;"> <span style="color: #990000; font-size: large;"><u>Setup SFTP-only User Accounts on CentOS</u></span></h1> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">The SSH File Transfer Protocol (also Secure File Transfer Protocol, or SFTP) is a network protocol that provides file access, file transfer, and file management over any reliable data stream. It was designed by the Internet Engineering Task Force (IETF) as an extension of the Secure Shell protocol (<a href="http://www.hackthesec.co.in/search/label/SSH">SSH</a>) version 2.0 to provide secure file </span></span></div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0UoU738wfzIiGQcNwEh7rGJzNHBJmmJiBCvuVQpMOAdQltLab9w4pAzEuFpSuexA7trPxiLLFCLlTR2TJ-Iuw-Tz4zF2QdvvYDZr5vwxR2dW0WcSbp6qnjOAC6quoc-tRpzxf6KI3tkgX/s1600/sftp-software-hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0UoU738wfzIiGQcNwEh7rGJzNHBJmmJiBCvuVQpMOAdQltLab9w4pAzEuFpSuexA7trPxiLLFCLlTR2TJ-Iuw-Tz4zF2QdvvYDZr5vwxR2dW0WcSbp6qnjOAC6quoc-tRpzxf6KI3tkgX/s1600/sftp-software-hackthesec.co.in.jpg" /></a></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">transfer capabilities. The IETF Internet Draft states that, even though this protocol is described in the context of the SSH-2 protocol, it could be used in a number of different applications, such as secure file transfer over Transport Layer Security (TLS) and transfer of management information in <a href="http://www.hackthesec.co.in/search/label/VPN">VPN </a>applications.</span></span></div> <div> <span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Step 1: Create a dedicated sFTP group and a dedicated sFTP user</u></b></span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: white;">groupadd sftpusers </span><span style="color: orange;">useradd -G sftpusers -s /sbin/nologin user1 </span><span style="color: white;">passwd user1</span></span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Here, the group <b>sftpusers </b>is a dedicated sFTP group, the user <b>user1 </b>is a dedicated sFTP user which is forbidden to log in using SSH.</span></span></div> <div> <span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>Step 2: Modify the configuration of the sshd service</u></b></span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Open the configuration file of the sshd service:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-size: large;"><span style="line-height: 20.8px;">vi /etc/ssh/sshd_config</span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Find the line:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: orange; font-size: large;"><span style="line-height: 20.8px;">Subsystem sftp /usr/libexec/openssh/sftp-server</span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Replace it with:</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: white;">Subsystem </span><span style="color: orange;">sftp internal-sftp</span></span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Append the following lines to the end of the file. The group name <b>sftpusers </b>should be the same as the one you specified earlier.</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: white;">Match Group sftpusers X11Forwarding no AllowTcpForwarding no </span><span style="color: orange;">ChrootDirectory %h </span><span style="color: white;">ForceCommand internal-sftp</span></span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Save and quit: use :wq</span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Restart the sshd service to put your changes into effect.</span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: white;">systemctl </span><span style="color: orange;">restart sshd.service</span></span></span></pre> </div> <div> <div style="font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> <b><u><span style="color: #0b5394;">Step 3: Create a dedicated directory for the sFTP-only user</span></u></b></div> <div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;"> You need to specify a directory for the sFTP-only user and make sure that this user can only play around in this directory:</div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: white;">chown -R root /home/user1 chmod -R 755 /home/user1 </span><span style="color: orange;">mkdir /home/user1/files </span><span style="color: white;">chown user1. /home/user1/files</span></span></span></pre> </div> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Now, the user <b>user1 </b>can only upload and/or download files in the directory <b>/home/user1/files</b>, he or she can never touch other users' files.</span></span></div> <div> <span style="font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><div> <b><u><span style="color: #0b5394;">Step 4: Create more sFTP-only users</span></u></b></div> <div style="color: #333333;"> If you need more sFTP-only users, you can create them in the same fashion:</div> </span></span></div> <div> <pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-size: large;"><span style="line-height: 20.8px;"><span style="color: orange;">useradd -G sftpusers -s /sbin/nologin user2 passwd user2</span><span style="color: white;"> chown -R root /home/user2 chmod -R 755 /home/user2 mkdir /home/user2/files chown user2. /home/user2/files</span></span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">That's it. Each user account created in this fashion will be denied if you use it to log in the system. These user accounts can be used only in sFTP programs.</span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></span></div> </div>

Setup SFTP-only User Accounts on CentOS 7

Setup SFTP-only User Accounts on CentOS The SSH File Transfer Protocol (also Secure File Transfer Protocol, or SFTP) is a network protoc...

Read more »