How To Chroot SFTP

Since version 4.8, OpenSSH supports chrooting. This guide will teach you how to lock users to a specific directory which they will not be able to leave(In My Example We Will Be Locking Users To their home directory).

Notes

I will use the user test here with the home directory /home/test. The user test belongs to the group users. I want to chroot the user to the /home directory.

Install OpenSSH

If you do not already have openssh installed please install it now. In Gentoo Issue This command to download and install the latest version of OpenSSH.

emerge -av openssh

Now we need to edit the ssh configuration file to enable SFTP.

nano /etc/ssh/sshd_config

Verify you have this line in the file:

Subsystem sftp /usr/lib/openssh/sftp-server

Then add the following stanza at the end of the file (add one for each user that you want to chroot):

Match User test
ChrootDirectory /home
AllowTCPForwarding no
X11Forwarding no
ForceCommand /usr/lib/openssh/sftp-server

Restart OpenSSH:

/etc/init.d/ssh restart

Now set each Users Home Directory private(unreadable by other users):

chmod 700 /home/test

Thats it Now Load up your favorite SFTP Client and give it a shot. It should
not be possible to leave the /home directory with the user test.

Enjoy..

Understanding Cron Jobs.

Crontab

The command to create/edit, list, and remove cron jobs is crontab. If you call it with the -u option, it specifies the name of the user whose crontab is to be edited. If this option is not given, crontab examines "your" crontab, i.e., the crontab of the user executing the command. If you are looged in as root and run crontab without -u, then root's crontab is listed/modified/removed. If you are logged in as test and run crontab without -u, then test's crontab is listed/modified/removed.

Some Examples:

crontab -l

lists the cron jobs of the user as that you are currently logged in:

test:~# crontab -l
* * * * * /usr/local/examplescript.sh > /dev/null 2>> /var/log/cron.log
30 00 * * * /usr/local/examplescript2.sh > /dev/null 2>> /var/log/cron.log
test:~#

crontab -u exampleuser -l (lists all cron jobs of exampleuser.)

crontab -e (let's you create/modify the cron jobs of the user as that you are currently logged in.)

crontab -u exampleuser -e (let's you create/modify the cron jobs of exampleuser.)

crontab -r (deletes all cron jobs of the user as that you're currently logged in.)

crontab -u exampleuser -r (deletes all cron jobs of exampleuser.)

Cronjob Syntax

A cron job consists out of six fields:

minute, hour ,day of month, month day of week, YourCommand

field          allowed values
-----          --------------
minute         0-59
hour           0-23
day of month   1-31
month          1-12 (or names, see below)
day of week    0-7 (0 or 7 is Sun, or use names)

When specifying day of week, both day 0 and day 7 will be considered Sunday.

A field may be an asterisk (*), which always stands for first-last.

Names can also be used for the "month" and "day of week" fields. Use the first three letters of the particular day or month (case doesn't matter), e.g. mon or MON for Monday or aug / AUG for August.

Lets look at these examples:

* * * * * /usr/local/example.sh > /dev/null 2>> /var/log/cron.log

This means: execute /usr/local/example.sh > /dev/null 2>> /var/log/cron.log once per minute.

30 00 * * * /usr/local/cron_daily.sh > /dev/null 2>> /var/log/cron.log

This means: execute /usr/local/cron_daily.sh > /dev/null 2>> /var/log/cron.log once per day at 00:30h.

You can also use ranges to define cron jobs:

Examples:

1,2,5,9 - means every first, second, fifth, and ninth (minute, hour, month, ...).

0-4,8-12 - means all (minutes, hours, months,...) from 0 to 4 and from 8 to 12.

*/5 - means every fifth (minute, hour, month, ...).

1-9/2 is the same as 1,3,5,7,9.

Ranges or lists of names are not allowed (if you are using names instead of numbers for months and days - e.g., Mon-Wed is not valid).

1,7,25,47 */2 * * * command

means: run command every second hour in the first, seventh, 25th, and 47th minute.

Instead of the first five fields, one of eight special strings may appear:

       string         meaning

    @reboot        Run once, at startup.
    @yearly        Run once a year, "0 0 1 1 *".
    @annually      (same as @yearly)
    @monthly       Run once a month, "0 0 1 * *".
    @weekly        Run once a week, "0 0 * * 0".
    @daily         Run once a day, "0 0 * * *".
    @midnight      (same as @daily)
    @hourly        Run once an hour, "0 * * * *".

How To Use Mod Rewrite to Clean Up URL's

If you have not enabled or setup Mod Rewrite Then Read This Guide Here.

Ok so lets compare these:

http://www.yoursite.com/index.php?p=contactus

With the power of the mod_rewrite apache module, we can make this URL much cleaner.

http://www.yoursite.com/contactus.html

so now that you get the idea, here is how the above can be accomplished:

RewriteRule ^([^/]+).html$ /index.php?p=$1 [QSA,L,NC]

Now If you wanted your URL to look like a directory, you would use this line instead of the previous line:

RewriteRule ^([^/]+)/?$ /index.php?p=$1 [QSA,L,NC]

This would return:

http://www.yoursite.com/contactus/