SFTP Help; One master account with total control and multiple sub accounts with limited control.

Alright since I did not get an answer I kept search and search and search and finally found something! I’m writing this up for another tutorial I’m creating so excuse any spelling mistakes and such, only the first draft (but it works!).

Before this section starts I want to give a massive shout-out to the user Time Sheep over at SuperUser.com for this answer. He came up with a fantastic solution for jailing users while still keeping www-data permissions for /var/www.

Basically we are going to jail the user to their home directory (ex. /home/john/www) and then mount (link) that www folder to the site the user has access to edit. We also supply the g+s & use setfacl to keep the new written data under the www-data permissions. When that is all done we save the mount in the fstab file for when the server reboots.

First we need to add a group for our users, we could call this any but keep it lower-case and without spaces or numbers. For example developer, sitename, content-advisor, etc… We are going to use sftp-only for these examples.

sudo groupadd sftp-only

Second check to see if /usr/sbin/nologin or /sbin/nologin is a valid shell.

$ less /etc/shells

If in the return list it does not exists CTRL+Z to exit out and add it with:

# Most systems:
echo "/sbin/nologin" >> /etc/shells
# Debian/Ubuntu:
echo "/usr/sbin/nologin" >> /etc/shells

Re-run a less on shell to see if it was added

$ less /etc/shells

SFTP will only work if the shell used on the user (in this case /usr/sbin/shell) is in the /etc/shells.

Third we need to setup the sftp-server Subsystem in sshd_config, open up the file:

$ sudo nano /etc/ssh/sshd_config

Locate the following line in the file and comment it out (if it is not already):

#Subsystem       sftp    /usr/libexec/openssh/sftp-server

and under it add

Subsystem       sftp    internal-sftp

after that add the following at the VERY END of the file with modified settings

Match Group sftp-only
    ChrootDirectory /home/%u
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

It must go at the very end or an error will be produced!

Save the file and restart ssh.

$ sudo service ssh restart

Finally we need to setup a chroot environment, this will lock the user to the /home/<username>/www folder which is mounted to /var/www/example.com. To add a new user run:

$ sudo useradd <username>
$ sudo usermod -g sftp-only -s /usr/sbin/nologin <username>
$ sudo chown root:root /home/<username>
$ sudo mkdir -p /home/<username>/www
$ sudo mount --bind /var/www/example.com /home/<username>/www
$ sudo chmod g+s /home/<username>/www
$ sudo chown -R <username>:www-data /home/<username>/www
$ sudo setfacl -d -m g::rwx /home/<username>/www
$ sudo nano /etc/fstab
# Add:
/var/www/example.com        /home/<username>/www        none        bind        0        0

Make sure to replace <username> with your user you are creating and replace the /var/www/example.com with the site you want the user to have access to. The user could also have access to multiple sites by linking multiple directories.

$ sudo mount --bind /var/www/example.com /home/<username>/site1
$ sudo mount --bind /var/www/example.net /home/<username>/site2
$ sudo mount --bind /var/www/example.org /home/<username>/site3

Make sure to set the proper permissions & add the lines in etc/fstab. As well the chroot directory must be own by root for sftp to work so the line $ sudo chown root:root /home/<username> is very much required!

You can repeat the above for an existing user, just ignore the useradd and proceed to usermod.

I also recommend using /usr/sbin/nologin over /bin/false as the user will get a polite message if they try to SSH saying “This account is currently not available” while /bin/false immediately exists the user out of shell. As well we added /usr/sbin/nologin above to the /etc/shell so might as well stay consistent.

Hope that helps others!