Gr0x0rd: Created page with "References: https://qiita.com/alokrawat050/items/fcbf86aaf7de34aacba5 https://askubuntu.com/questions/324503/2-sshd-configurations-1-for-internal-and-1-external Ensure the..."

2023-02-03T06:09:44Z

Created page with "References: https://qiita.com/alokrawat050/items/fcbf86aaf7de34aacba5 https://askubuntu.com/questions/324503/2-sshd-configurations-1-for-internal-and-1-external Ensure the..."

New page

References:

https://qiita.com/alokrawat050/items/fcbf86aaf7de34aacba5

https://askubuntu.com/questions/324503/2-sshd-configurations-1-for-internal-and-1-external

Ensure the openssh-server and ssh packages are installed.
 
Add the desired user account. Configure the password and store it in the vault.
$ sudo adduser sftp_user
Create the file transfer directory if it is needed.
$ sudo mkdir -p /var/www/testsite/data
Set the directory permissions for the root folder.
$ sudo chown root:root /var/www/testsite
$ sudo chmod 755 /var/www/testsite
Set the directory permissions for the data fodler.
$ sudo chown sftp_user:sftp_user /var/www/testsite/data
Create a second ssh instance.
$ sudo cp /etc/ssh/sshd_config /etc/ssh/sftp_config
$ sudo cp /lib/systemd/system/ssh.service /lib/systemd/system/sftp.service
Configure the new instance to read the new config file.
$ sudo nano /lib/systemd/system/sftp.service
Ensure the following configuration:
<pre>
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS -f /etc/ssh/sftp_config
...
Alias=sftp.service
</pre>
Make the necessary changes to the config file.
$ sudo nano /etc/ssh/sftp_config
Set the port as appropriate. Example for password auth:
<pre>
Port <your_port_number>
...
Match User sftp_user
ForceCommand internal-sftp
PasswordAuthentication yes
ChrootDirectory /var/www/testsite
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
</pre>
Example for shared key auth:
<pre>
Port <your_port_number>
...
Match User sftp_user
ForceCommand internal-sftp
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no
ChrootDirectory /var/www/testsite
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
</pre>
Enable and start the service.
$ sudo systemctl enable sftp.service
$ sudo systemctl start sftp.service
Optional: use telnet to confirm the service is now running on the desired port.
 
$ sudo nano /etc/csf/csf.conf
Ensure that the port you have added for the service and configured above are present in the TCP_IN/TCP_OUT sections of the file. When done restart the firewall
$ sudo systemctl restart csf
$ sudo csf -r
$ sudo systemctl restart lfd
 
Use the [[Ssh_keypair_setup]] documentation to set up a keypair for the sftp_user account. Make sure the user account is the owner of the .ssh folder and its perms are set to 700. Also make sure the account is the owner of the authorized_keys file, and the perms are set to 600.

Sftp server - Revision history

Gr0x0rd: Created page with "References: https://qiita.com/alokrawat050/items/fcbf86aaf7de34aacba5 https://askubuntu.com/questions/324503/2-sshd-configurations-1-for-internal-and-1-external Ensure the..."