Blue Light
Space shortcuts
Child pages
  • SFTP
Skip to end of metadata
Go to start of metadata

 

Introduction

SFTP (SSH File Transfer Protocol) allows the access of data over the network. It is not based on FTP but rather is an extension of the SSH protocol. Again, it is different from FTP over SSH.

Install

Debian 6.0 / 7.0 - Ubuntu 12.04 - Raspbian Wheezy

Install the software

sudo apt-get update
sudo apt-get install openssh-server

 

Create sftp group

In order to limit the usage of the sftp folders we create a group which will be used only for the sftp users/folders.

sudo groupadd <sftpgroup>

 

Create sftp users

It is recommended to not use a system user which has access to other things than the sftp folders.

The group id is needed for the creation of the sftp users. In order to find it out:

sudo grep <sftpgroup> /etc/group

Create a user:

sudo useradd <username> -d / -g <sftpgroupid> -M -N -o -u <sftpgroupid>
sudo passwd  <username>

The arguments we used:

  • -d is the user home directory which needs to be set to / (root).
  • -g is the user group id to assign which in our example needs to be assigned to sftponly.
  • -M stops the useradd command creating a home directory.
  • -N useradd by default creates a group with the same name as the new user, this disables that behaviour.
  • -u is the user id, which in our case needs to be the same id value as sftponly.
  • -o allows duplicate, non-unique user ids.

 

Configure ssh

Edit /etc/ssh/sshd_config and modify:

Subsystem sftp /usr/lib/openssh/sftp-server

to

Subsystem sftp internal-sftp

 

Add at the end of the file and replace <sftpfolder> by the folder you are going to use for sftp:

# SFTP configuration
 Match group <sftpgroup>
ChrootDirectory <sftpfolder>
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

For the users to chroot into their home directory replace <sftpfolder> by %h

Create the folder structure

The root sftp folder needs to be set as owner root and permissions 755.

The folders and files under the ChrootDirectory need to be set has part of the group sftp.

Here are the right folder permissions for the following situation:

  • No access: 700
  • Read only access: 750
  • Read and Write access: 770

Access

From Nautius

Type Ctrl + L once in Nautilus

In the address bar enter the sftp address as follow:

sftp://user@ip/folder