Adding the Restricted SFTP User to the System

Sometimes it is needed to give access for a user to one and only one folder. For example, if your run a web hosting and your client ask you to give him access to his website's files. And you don’t have a control panel or FTP configured on your server.

There is a solution to it!

This lecture is about setting up SFTP users who’s access is restricted to their home directories.

As you have SSH set up and running, you also have the SFTP set up as well.

First of all, we need to add a new user to a home directory that this user will be restricted to. To do this, we run:

adduser --home /home/www/directory restricted_user

This will create a user restricted_user, the directory /home/www/directory and then set the permissions on the directory so the user can write to it. It won't have an ability to write to any other directory by default.

If you have a sort of web hosting, then you probably have already user's "home" directory with files in it. Then you need to add --no-create-home option to adduser command:

adduser --no-create-home restricted_user

You will be prompted for some additional information about the user being created and for the user's password.

Now let's set user's group:

usermod steve -g sftponly

To deny SSH shell access, run the following command:

usermod steve -s /bin/false

After the user was created and tuned, we need to make changes to /etc/ssh/sshd_config file. In some configurations, it may be located in /etc/sshd_config (just for info).

Add the following to the end of the /etc/ssh/sshd_config file:

Subsystem sftp internal-sftp

Match Group sftponly
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no

Make sure that "Match…" block is placed at the very end of sshd_config file.

This block makes sure that all users in the ‘sftponly’ group will be chrooted to their home directory, where they only will be able to run internal SFTP processes.

Finally, we need to restart SSH:

sudo service ssh restart

After that, the SSH side should be in order, but you should make sure that file permissions are correct as well. Make sure that both /home and /home/username directories are owned by root and have permissions along the lines of 755 or 750. We want to be sure that every folder leading up to and including the home folder must be owned by root. If that's not the case we will get the "Broken pipe" or "Connection reset by peer" error after logging in.