List of user’s group
# groups username
# adduser username -g sftp -s /sbin/nologin # passwd username
in general to add a new group
in general to add user to a group
#usermod -G group username
Open and add the following lines to
/etc/ssh/sshd_config configuration file:
list of groups and its users # cat /etc/group Subsystem sftp internal-sftp Match Group sftp ChrootDirectory /home/%u ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no
# systemctl restart sshd OR # service sshd restart then check the user home directory permissions # ls /home/ -ltra in case run this # chmod 755 /home/username/ # chown root:sftp /home/username/ -Rf
# chown username:sftp /home/username/basedir
I had this error when I tried to create folder in basedir:
mkdir /New directory: permission denied
after googlig a lot I found this here (Thanks):
# setsebool -P ssh_chroot_rw_homedirs on # restorecon -R /home/username
After this, sftp works as expected, even when chrooted, without having to disable SELinux completely.
This tutorial will help you to create SFTP only user (without ssh access) on CentOS and RedHat systems. The user can connect the server with SFTP access only and allowed to access the specified directory. User can’t SSH into the server. Follow the below tutorial to create sftp only account.
Step 1 – Create Account
First of all, create a user account to use for sftp access. Below command will create user named sftpuser with no shell access.
sudo adduser --shell /bin/false sftpuser sudo passwd sftpuser
Step 2 – Create Directory
Now, create the directory structure to be accessible by sftp user.
sudo mkdir -p /var/sftp/files
Change the ownership of the files directory to sftp user. So that sftpuser can read and write on this directory.
sudo chown sftpuser:sftpuser /var/sftp/files
And set the owner and group owner of the /var/sftp to root. The root user has read/write access on this access. Group member and other account have only read and execute permissions.
sudo chown root:root /var/sftp sudo chmod 755 /var/sftp
Step 3 – Configure SSH for SFTP
Now edit the SSH configuration file in a text editor
sudo vim /etc/ssh/sshd_config
and add the following settings at end of file.
Match User sftpuser ForceCommand internal-sftp PasswordAuthentication yes ChrootDirectory /var/sftp PermitTunnel no AllowAgentForwarding no AllowTcpForwarding no X11Forwarding no
Save the configuration and restart SSH service to apply changes.
sudo systemctl restart sshd.service