How To Chroot SFTP

Since version 4.8, OpenSSH supports chrooting. This guide will teach you how to lock users to a specific directory which they will not be able to leave(In My Example We Will Be Locking Users To their home directory).

Notes

I will use the user test here with the home directory /home/test. The user test belongs to the group users. I want to chroot the user to the /home directory.

Install OpenSSH

If you do not already have openssh installed please install it now. In Gentoo Issue This command to download and install the latest version of OpenSSH.

emerge -av openssh

Now we need to edit the ssh configuration file to enable SFTP.

nano /etc/ssh/sshd_config

Verify you have this line in the file:

Subsystem sftp /usr/lib/openssh/sftp-server

Then add the following stanza at the end of the file (add one for each user that you want to chroot):

Match User test
ChrootDirectory /home
AllowTCPForwarding no
X11Forwarding no
ForceCommand /usr/lib/openssh/sftp-server

Restart OpenSSH:

/etc/init.d/ssh restart

Now set each Users Home Directory private(unreadable by other users):

chmod 700 /home/test

Thats it Now Load up your favorite SFTP Client and give it a shot. It should
not be possible to leave the /home directory with the user test.

Enjoy..

Installing ProFTPD W/TLS

As we know or should know FTP protocol is very insecure, the username and password are sent over the wire in plaintext form. Which would allow anyone listening in to see that information and then there is nothing stopping them from using this for their own personal gain.

This Guide Teaches you howto install Proftpd (my Favorite FTP Server) with tls support which allows for a sftp session(encrypted ftp basically using OpenSSL).

Notes:

In this tutorial I use the hostname linux.example.com with the IP address 192.168.1.10. These settings might differ for you, so you have to replace them where appropriate.

Installing Proftpd

issue:
emerge -av proftpd

Now you should see something like this, make sure you have
ssl in your proftpd use flags.(use strings in red are enabled)

emerge -av proftpd

* IMPORTANT: 1 news items need reading for repository 'gentoo'.
* Use eselect news to read news items.


These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild N ] net-ftp/ftpbase-0.01-r1 USE="pam" 0 kB
[ebuild N ] net-ftp/proftpd-1.3.2-r2 USE="acl ipv6 ldap ncurses nls pam ssl tcpd -authfile -ban -case -clamav -deflate -hardened -ifsession -kerberos -mysql -noauthunix -opensslcrypt -postgres -radius -rewrite (-selinux) -shaper -sitemisc -softquota -vroot -xinetd" 2,400 kB

Total: 2 packages (2 new), Size of downloads: 2,400 kB

Would you like to merge these packages? [Yes/No]

Type yes and continue

Now that we have proftpd installed with ssl support, we are ready to generate
our certificates.

mkdir /etc/proftpd/ssl
openssl req -new -x509 -days 365 -nodes -out /etc/proftpd/ssl/proftpd.cert.pem -keyout /etc/proftpd/ssl/proftpd.key.pem

Fill out the questions accordingly
And now we you need to edit the proftpd configuration file /etc/proftpd.conf

nano /etc/proftpd/proftpd.conf

Change the Values To Match These Below:

Include /etc/proftpd/tls.conf
DefaultRoot ~
IdentLookups off
ServerIdent on "FTP Server ready."

Now Open /etc/proftpd/tls.conf for editing:

nano /etc/proftpd/tls.conf

And Edit the tls.conf to match this:

TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol SSLv23
TLSOptions NoCertRequest
TLSRSACertificateFile /etc/proftpd/ssl/proftpd.cert.pem
TLSRSACertificateKeyFile /etc/proftpd/ssl/proftpd.key.pem
TLSVerifyClient off
TLSRequired on

If you use TLSRequired on, then only TLS connections are allowed (this locks out any users with old FTP clients that don't have TLS support); by commenting out that line or using TLSRequired off both TLS and non-TLS connections are allowed, depending on what the FTP client supports.

Now Restart the proftpd daemon

/etc/init.d/proftpd restart

You Are DONE! now you can go ahead and use your favorite sftp client, I like SecureFX.