How To Restrict SFTP Users Home Directories in Linux
To Restrict SFTP Users Home Directories in Linux
Restricting Users Home directories is important, especially in a shared server environment. So the unauthorized user cannot access the other user’ s files. The various steps to Restrict SFTP Users Home Directories Using chroot Jail is explained in this article.
1. Restricting SFTP Users to Home Directories
To Create or Modify Users and Groups
Restrict the existing user to home directory and create a new group by using the groupadd command as shown below.
[root@linuxhelp ~]# groupadd group1
Now you need to assign the existing user to “ group1” group.
[root@linuxhelp ~]# usermod -G group1 user1
Modifying the SSH Configuration File
Open " /etc/ssh/sshd_config" file and mention the directory to be blocked in chrootdirectory column.
[root@linuxhelp ~]# vim /etc/ssh/sshd_config
Append the following lines.
Subsystem sftp internal-sftp Match Group group1 ChrootDirectory /home ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no
Save and quit the file.
Restart sshd service to bring new changes into effect.
[root@linuxhelp ~]# systemctl restart sshd OR [root@linuxhelp ~]# service sshd restart
Modify the permission of " user 1" to block the access from other users.
[root@linuxhelp ~]# chmod 700 /home/user1
Checking SSH and SFTP Users Login
Verify the login from a local host and try to login with ssh in remote host.
[root@linuxhelp ~]# ssh user1@192.168.5.88
user1@192.168.5.88' s password:
Could not chdir to home directory /home/user1: No such file or directory
This service allows sftp connections only.
Connection to 192.168.5.88 closed.
You cannot login to the remote host via ssh connection. Try logging with SFTP.
[root@linuxhelp ~]# sftp user1@192.168.5.88 user1@192.168.5.88' s password: Connected to 192.168.5.88. sftp>
Verify the current working directory.
sftp> pwd Remote working directory: / sftp> ls user1
Move to user1 directory and now you have access to create files or folders. If you try to access any other directories, error occurs.
sftp> cd user1 sftp> cd /root Couldn' t canonicalise: No such file or directory
2. Restricting SFTP Users to a Specific Directory
In ssh configuration file, change the " ChrootDirectory" to any other directory that you want to restrict. Here, we are restricting /project/files.
[root@linuxhelp ~]# vim /etc/ssh/sshd_config
Match Group group1
ChrootDirectory /project/files
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding no
Create the directory, as we mentioned in the ssh configuration file.
[root@linuxhelp ~]# mkdir -p /project/files
Now restart sshd service to bring the changes into effect.
[root@linuxhelp ~]# systemctl restart sshd OR [root@linuxhelp ~]# service sshd restart