Trouble setting up an sftp chroot jail
I'm following the SFTP chroot wiki on ArchWiki and finding a huge snag: I can't get my sftponly users authorized.
Output of tail -2 /etc/passwd (my 2 users):
chris:x:1001:1002::/home/jail:/usr/bin/nologin
rick:x:1002:1002::/home/jail:/usr/bin/nologin
Output of groups chris and groups rick:
sftponly
The directory:
$ ls -l /home
total 24
drwxr-xr-x 3 root root 4096 Jan 9 16:12 jail/
$ ls -l /home/jail
total 4
drwxrwxr-x 3 rick sftponly 4096 Jan 9 16:12 dropbox/
note: the only reason the dropbox/ directory is owned by rick is because I was experimenting with changing ownership of files within the chroot jail directory because this was something I'd read about in my extensive googling. I would like the both chris and rick to be able to edit the same files. I will investigate facl permissions when I get to the point that I can even log them in.
The relevant section in /etc/ssh/sshd_config
Subsystem sftp /usr/lib/ssh/sftp-server
Match Group sftponly
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
PasswordAuthentication yes
From the log when I try to log in via sftp rick@localhost and enter the password:
Jan 09 16:44:17 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:23 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:28 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:29 dell-dropbox sshd[688]: Connection closed by authenticating user rick ::1 port 57410 [preauth]
note: They both have passwords set. I am typing in the password correctly. I can sftp in as myself without any problem.
What on earth am I missing?
ssh chroot sftp
asked Jan 9 at 21:49
malanmalan
619421
add a comment |
I'm following the SFTP chroot wiki on ArchWiki and finding a huge snag: I can't get my sftponly users authorized.
Output of tail -2 /etc/passwd (my 2 users):
chris:x:1001:1002::/home/jail:/usr/bin/nologin
rick:x:1002:1002::/home/jail:/usr/bin/nologin
Output of groups chris and groups rick:
sftponly
The directory:
$ ls -l /home
total 24
drwxr-xr-x 3 root root 4096 Jan 9 16:12 jail/
$ ls -l /home/jail
total 4
drwxrwxr-x 3 rick sftponly 4096 Jan 9 16:12 dropbox/
note: the only reason the dropbox/ directory is owned by rick is because I was experimenting with changing ownership of files within the chroot jail directory because this was something I'd read about in my extensive googling. I would like the both chris and rick to be able to edit the same files. I will investigate facl permissions when I get to the point that I can even log them in.
The relevant section in /etc/ssh/sshd_config
Subsystem sftp /usr/lib/ssh/sftp-server
Match Group sftponly
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
PasswordAuthentication yes
From the log when I try to log in via sftp rick@localhost and enter the password:
Jan 09 16:44:17 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:23 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:28 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:29 dell-dropbox sshd[688]: Connection closed by authenticating user rick ::1 port 57410 [preauth]
note: They both have passwords set. I am typing in the password correctly. I can sftp in as myself without any problem.
What on earth am I missing?
ssh chroot sftp
asked Jan 9 at 21:49
malanmalan
619421
I have theSubsystemline commented out and instead put the line:Subsystem sftp internal-sftp, that works for me.
– RoVo
Jan 10 at 13:29
@RoVo I saw that in a couple of google results. My understanding is theForceCommand internal-sftpoverrides it for those accounts, but perhaps it doesn't work? I will try what you suggest. I'm curious if there's a security issue with it though, and if not, why Arch doesn't suggest it on the Wiki. Thanks for the tip.
– malan
Jan 10 at 15:04
Nope, didn't work. :-(
– malan
Jan 10 at 15:21
add a comment |
I'm following the SFTP chroot wiki on ArchWiki and finding a huge snag: I can't get my sftponly users authorized.
Output of tail -2 /etc/passwd (my 2 users):
chris:x:1001:1002::/home/jail:/usr/bin/nologin
rick:x:1002:1002::/home/jail:/usr/bin/nologin
Output of groups chris and groups rick:
sftponly
The directory:
$ ls -l /home
total 24
drwxr-xr-x 3 root root 4096 Jan 9 16:12 jail/
$ ls -l /home/jail
total 4
drwxrwxr-x 3 rick sftponly 4096 Jan 9 16:12 dropbox/
note: the only reason the dropbox/ directory is owned by rick is because I was experimenting with changing ownership of files within the chroot jail directory because this was something I'd read about in my extensive googling. I would like the both chris and rick to be able to edit the same files. I will investigate facl permissions when I get to the point that I can even log them in.
The relevant section in /etc/ssh/sshd_config
Subsystem sftp /usr/lib/ssh/sftp-server
Match Group sftponly
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
PasswordAuthentication yes
From the log when I try to log in via sftp rick@localhost and enter the password:
Jan 09 16:44:17 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:23 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:28 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:29 dell-dropbox sshd[688]: Connection closed by authenticating user rick ::1 port 57410 [preauth]
note: They both have passwords set. I am typing in the password correctly. I can sftp in as myself without any problem.
What on earth am I missing?
ssh chroot sftp
asked Jan 9 at 21:49
malanmalan
619421
I'm following the SFTP chroot wiki on ArchWiki and finding a huge snag: I can't get my sftponly users authorized.
Output of tail -2 /etc/passwd (my 2 users):
chris:x:1001:1002::/home/jail:/usr/bin/nologin
rick:x:1002:1002::/home/jail:/usr/bin/nologin
Output of groups chris and groups rick:
sftponly
The directory:
$ ls -l /home
total 24
drwxr-xr-x 3 root root 4096 Jan 9 16:12 jail/
$ ls -l /home/jail
total 4
drwxrwxr-x 3 rick sftponly 4096 Jan 9 16:12 dropbox/
note: the only reason the dropbox/ directory is owned by rick is because I was experimenting with changing ownership of files within the chroot jail directory because this was something I'd read about in my extensive googling. I would like the both chris and rick to be able to edit the same files. I will investigate facl permissions when I get to the point that I can even log them in.
The relevant section in /etc/ssh/sshd_config
Subsystem sftp /usr/lib/ssh/sftp-server
Match Group sftponly
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
PasswordAuthentication yes
From the log when I try to log in via sftp rick@localhost and enter the password:
Jan 09 16:44:17 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:23 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:28 dell-dropbox sshd[688]: Failed password for rick from ::1 port 57410 ssh2
Jan 09 16:44:29 dell-dropbox sshd[688]: Connection closed by authenticating user rick ::1 port 57410 [preauth]
note: They both have passwords set. I am typing in the password correctly. I can sftp in as myself without any problem.
What on earth am I missing?
ssh chroot sftp
ssh chroot sftp
asked Jan 9 at 21:49
malanmalan
619421
asked Jan 9 at 21:49
malanmalan
619421
edited Jan 10 at 13:25
malan
asked Jan 9 at 21:49
malanmalan
619421
asked Jan 9 at 21:49
malanmalan
619421
asked Jan 9 at 21:49
malanmalan
619421
619421
I have theSubsystemline commented out and instead put the line:Subsystem sftp internal-sftp, that works for me.
– RoVo
Jan 10 at 13:29
@RoVo I saw that in a couple of google results. My understanding is theForceCommand internal-sftpoverrides it for those accounts, but perhaps it doesn't work? I will try what you suggest. I'm curious if there's a security issue with it though, and if not, why Arch doesn't suggest it on the Wiki. Thanks for the tip.
– malan
Jan 10 at 15:04
Nope, didn't work. :-(
– malan
Jan 10 at 15:21
add a comment |
I have theSubsystemline commented out and instead put the line:Subsystem sftp internal-sftp, that works for me.
– RoVo
Jan 10 at 13:29
@RoVo I saw that in a couple of google results. My understanding is theForceCommand internal-sftpoverrides it for those accounts, but perhaps it doesn't work? I will try what you suggest. I'm curious if there's a security issue with it though, and if not, why Arch doesn't suggest it on the Wiki. Thanks for the tip.
– malan
Jan 10 at 15:04
Nope, didn't work. :-(
– malan
Jan 10 at 15:21
I have the
Subsystem line commented out and instead put the line: Subsystem sftp internal-sftp, that works for me.– RoVo
Jan 10 at 13:29
I have the
Subsystem line commented out and instead put the line: Subsystem sftp internal-sftp, that works for me.– RoVo
Jan 10 at 13:29
@RoVo I saw that in a couple of google results. My understanding is the
ForceCommand internal-sftp overrides it for those accounts, but perhaps it doesn't work? I will try what you suggest. I'm curious if there's a security issue with it though, and if not, why Arch doesn't suggest it on the Wiki. Thanks for the tip.– malan
Jan 10 at 15:04
@RoVo I saw that in a couple of google results. My understanding is the
ForceCommand internal-sftp overrides it for those accounts, but perhaps it doesn't work? I will try what you suggest. I'm curious if there's a security issue with it though, and if not, why Arch doesn't suggest it on the Wiki. Thanks for the tip.– malan
Jan 10 at 15:04
Nope, didn't work. :-(
– malan
Jan 10 at 15:21
Nope, didn't work. :-(
– malan
Jan 10 at 15:21
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f493565%2ftrouble-setting-up-an-sftp-chroot-jail%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f493565%2ftrouble-setting-up-an-sftp-chroot-jail%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I have the
Subsystemline commented out and instead put the line:Subsystem sftp internal-sftp, that works for me.– RoVo
Jan 10 at 13:29
@RoVo I saw that in a couple of google results. My understanding is the
ForceCommand internal-sftpoverrides it for those accounts, but perhaps it doesn't work? I will try what you suggest. I'm curious if there's a security issue with it though, and if not, why Arch doesn't suggest it on the Wiki. Thanks for the tip.– malan
Jan 10 at 15:04
Nope, didn't work. :-(
– malan
Jan 10 at 15:21