Introduction

SFTP (SSH File Transfer Protocol) allows the access of data over the network. It is not based on FTP but rather is an extension of the SSH protocol. Again, it is different from FTP over SSH.

Install

Debian 6.0 / 7.0 - Ubuntu 12.04 - Raspbian Wheezy

Install the software

sudo apt-get update
sudo apt-get install openssh-server

Create sftp group

In order to limit the usage of the sftp folders we create a group which will be used only for the sftp users/folders.

sudo groupadd <sftpgroup>

Create sftp users

It is recommended to not use a system user which has access to other things than the sftp folders.

The group id is needed for the creation of the sftp users. In order to find it out:

sudo grep <sftpgroup> /etc/group

Create a user:

sudo useradd <username> -d / -g <sftpgroupid> -M -N -o -u <sftpgroupid>
sudo passwd  <username>

The arguments we used:

• -d is the user home directory which needs to be set to / (root).
• -g is the user group id to assign which in our example needs to be assigned to sftponly.
• -M stops the useradd command creating a home directory.
• -N useradd by default creates a group with the same name as the new user, this disables that behaviour.
• -u is the user id, which in our case needs to be the same id value as sftponly.
• -o allows duplicate, non-unique user ids.

Configure ssh

Edit /etc/ssh/sshd.conf and modify:

Subsystem sftp /usr/lib/openssh/sftp-server

to

Subsystem sftp internal-sftp

Add at the end of the file and replace <sftpfolder> by the folder you are going to use for sftp:

# SFTP configuration
 Match group <sftpgroup>
ChrootDirectory <sftpfolder>
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

For the users to chroot into their home directory replace <sftpfolder> by %h

Create the folder structure

The folders and files under the ChrootDirectory need to be set has part of the group sftp.

Here are the right folder permissions for the following situation:

• No access: 700
• Read only access: 750
• Read and Write access: 770