Securing SFTP access with Chroot and blocking the use of SSH

If you want to configure users on your system that will be used only to transfer files (and not to access the system over ssh), you need to configure what is called an SFTP Chroot Jail.

In a typical sftp scenario (when chroot sftp is not configured), if you use sftp, you can see the root file as shown below.

Non-Chroot SFTP environment

In the following example (a typical sftp environment), tester can use sftp on the system, display the /etc folder and download files such as the /etc/passwd file which contains all the information relating to users (login, passwords, etc.).

sftp tester@awoui
tester@awoui's password:
sftp> pwd
Remote working directory: /home/tester

sftp> ls
téléchargements documents 

sftp> cd /etc
sftp> ls -l passwd
-rw-r--r--    0 0        0            3750 Dec 29 23:09 passwd

sftp> get passwd
Fetching /etc/passwd to passwd
/etc/passwd     100% 3750     3.7KB/s   00:00

Chroot SFTP environment

In the following example, tester can use sftp on the system and only display the directory that you have designated for tester.

When tester tries to run "cd /etc", it will display an error message. Since SFTP is configured in a chroot environment, tester cannot display any other file on the system.

sftp tester@awoui
tester@awoui's password:
sftp> pwd
Remote working directory: /home/testeur

sftp> ls
sftp> cd /etc
Couldn't canonicalise: No such file or directory

Now that you know what the Chroot SFTP environment is, let's see how to configure it.

1. Create a new group

Create a group called sftp. Only users belonging to this group will be automatically restricted to the SFTP chroot environment on this system.

groupadd sftp

2. Create users (or modify an existing user)

Suppose you want to create a user Tom who should only be allowed to run SFTP in a chroot environment, and who should not be allowed to run SSH.

The following command creates the user "Tom", assigns this user to the sftp group and makes /home the home directory. Setting /sbin/nologin as the shell will prevent the user from using ssh and getting shell access).

useradd -g sftp -d /home -s /sbin/nologin tom
passwd tom

Verify that the user has been created correctly.

grep tom /etc/passwd
tom:x:500:500::/home:/sbin/nologin

If you want to modify an existing user and make them an sftp-only user and put them in the sftp chroot jail, proceed as follows:

usermod -g sftp -d /home -s /sbin/nologin tom

In the same vein, if you need to transfer files from Windows to Linux, use one of the sftp clients such as filezilla or winscp.

3. Configure the sftp-server subsystem in sshd_config

You should tell sshd to use the internal sftp for sftp (instead of the default sftp server).

Modify the /etc/ssh/sshd_config file and comment out the following line:

#Subsystem       sftp    /usr/libexec/openssh/sftp-server

Then, add the following line to the /etc/ssh/sshd_config file:

Subsystem       sftp    internal-sftp

Save then exit the file /etc/ssh/sshd_config.

You can check again using the grep command:

grep sftp /etc/ssh/sshd_config
#Subsystem      sftp    /usr/libexec/openssh/sftp-server
Subsystem       sftp    internal-sftp

4. Specify the chroot directory for a group

You only want to put certain users (that is to say the users belonging to the sftp group) in the chroot jail environment. Add the following lines to the end of /etc/ssh/sshd_config

nano /etc/ssh/sshd_config
Match Group sftp
        ChrootDirectory /sftp/%u
        ForceCommand internal-sftp

Above:

• Match Group sftp - This indicates that the following lines will only be applied for users belonging to the sftp group.
• ChrootDirectory/sftp/% u - This is the path that will be used after the user is authenticated. % u indicates the user. So, for Tom, it will be /sftp/christophe.
• ForceCommand internal-sftp - This forces the execution of the internal-sftp and ignores any command mentioned in the ~/.ssh/rc file.

5. Create an sftp base directory

Since we specified /sftp as the ChrootDirectory above, create this directory (which is the equivalent of your typical /home directory).

mkdir /sftp

Now, under /sftp, create the individual directories for the users who are part of the sftp group. That is to say the users who will only be allowed to run sftp and who will be in the chroot environment.

mkdir /sftp/tom

Thus, /sftp/tom is equivalent to / for Tom. When Tom uses sftp and runs "cd /", he will only see the content of the directories under "/sftp/tom" (and not the real root / of the system). This is the power of chroot.

Thus, under this /sftp/tom directory, create any subdirectory that you want the user to see. For example, create an incoming directory in which users can send their files.

mkdir /sftp/tom/home

6. Configuring the appropriate permissions

For chroot to work correctly, you must make sure that the appropriate permissions are correctly configured on the directory that you have just created above.

Set the ownership to the user and the sftp group as shown below.

chown tom:sftp /sftp/tom/home

The permission will look like the following for the incoming directory.

ls -ld /sftp/tom/home
drwxr-xr-x 2 to sftp 4096 Dec 28 23:49 /sftp/tom/home

The permission will look like the following for the /sftp/tom directory

ls -ld /sftp/tom
drwxr-xr-x 3 root root 4096 Dec 28 23:49 /sftp/tom

ls -ld /sftp
drwxr-xr-x 3 root root 4096 Dec 28 23:49 /sftp

7. Restart sshd and test Chroot SFTP

Restart sshd:

service ssh restart

Test the sftp chroot environment. As you see below, when tom does sftp, and does "cd /", he will only see the incoming directory.