I want to configure sftp-server to share a directory but I don't know how to modify /etc/ssh/sshd_config.
My requirements are:
1) Login shall not use certificates, only password (i.e. authorization uses password method)
2) I want to login with user: ftp, password: foo and share directory /home/ftp.
3) I have an application which from time to time needs to download a file from the server, I don't need to login with a full operating client.
So far I added the following lines to /etc/ssh/sshd_config:
Protocol 2 Subsystem sftp /usr/libexec/sftp-server Match User ftp ForceCommand internal-sftp ChrootDirectory /home/ftp Everything else is commented.
/home/ftp is an empty directory at present moment.
Access works if I try to download a file using root credentials but it doesn't work if I use ftp credentials. Do I need to set a login shell? Do I need to populate /home/ftp somehow?
EDIT: This is my sshd log:
subsystem request for sftp debug1: subsystem: exec() internal-sftp debug1: Forced command (config) 'internal-sftp ' debug2: fd 3 setting TCP_NODELAY debug2: fd 9 setting O_NONBLOCK debug2: fd 8 setting O_NONBLOCK debug1: Received SIGCHLD. debug1: session_by_pid: pid 17613 debug1: session_exit_message: session 0 channel 0 pid 17613 debug2: channel 0: request exit-status confirm 0 debug1: session_exit_message: release channel 0 debug2: channel 0: write failed debug2: channel 0: close_write debug2: channel 0: send eow debug2: channel 0: output open -> closed debug2: channel 0: read<=0 rfd 9 len 0 debug2: channel 0: read failed debug2: channel 0: close_read debug2: channel 0: input open -> drain debug2: channel 0: ibuf empty debug2: channel 0: send eof debug2: channel 0: input drain -> closed debug2: channel 0: send close debug2: notify_done: reading debug3: channel 0: will not send data after close debug3: channel 0: will not send data after close User child is on pid 17611 debug3: mm_request_receive entering * The client hangs here (until a timeout occurs) *
Please note, again, that if I login as "root" the file downloads correctly. It also downloads correctly if I comment out the last three lines of the configuration file (i.e. the Match line and the following 2).
1 Answer
You need make sure /home/ftp is owned by root and that group and others don't have write permissions, e.g. chmod 0755. You need to add sub-directories for ftp to add files in.
You also need the internal-sftp subsystem, otherwise you need to provide a proper chroot environment in /home/ftp:
Subsystem sftp internal-sftp To disallow all non-password kinds of login, enter
ChallengeResponseAuthentication no GSSAPIAuthentication no PubkeyAuthentication no These are activated by default.
5
