How do I restrict SFTP users to their home directory?

I often have to share resources with clients,  but allowing them to “play” with the entire file system of the web app, might end up in disaster.

That’s why I decided to write this little guide on how to restrict SFTP users to their home directory and share folders.

RESTRICT SFTP ACCESS TO HOME DIRECTORY

First, we need to modify the sshd_config file which contains all the ssh configurations.

sudo nano /etc/ssh/sshd_config

Make sure the following line is enabled, otherwise add it yourself.

Subsystem sftp internal-sftp  -f AUTH -l VERBOSE

On DigitalOcean I had the following line, which I replaced.

Subsystem sftp /usr/lib/openssh/sftp-server

At the end of the file, add the following, make sure that the /home/myuser folder is owned by root.

This configuration will block the user to ssh connect to the server and restrict her to the home directory myuser.

Match User myuser
       ChrootDirectory /home/myuser
       ForceCommand internal-sftp
       AllowTcpForwarding no
       X11Forwarding no

Now we just need to restart the ssh service

sudo service ssh restart

Normally we would use the ln -s command to do a symlink but when using chroot to restrict access to the home directory, that command won’t work.

Luckily the mount command comes in our help, using the option bind  we are able to link the resource (/var/www/myfolder/var) into the user home directory in the folder import.

cd /home/myuser
mount -o bind /var/www/myfolder/var/import import

Please note that if you reboot the server, you will have to re-run this command.

I hope this article will help all of you that are trying to achieve the same with your lovely clients.

Move to user1 directory and now you have access to create files or folders. If you try to access any other directories, error occurs.

sftp>  cd user1
sftp>  cd /root
Couldn' t canonicalise: No such file or directory

2. Restricting SFTP Users to a Specific Directory

In ssh configuration file, change the " ChrootDirectory" to any other directory that you want to restrict. Here, we are restricting /project/files.

[[email protected] ~]# usermod -G group1 user1

Create the directory, as we mentioned in the ssh configuration file.

[[email protected] ~]# usermod -G group1 user1

Now restart sshd service to bring the changes into effect.

[[email protected] ~]# systemctl restart sshd
OR
[[email protected] ~]# service sshd restart

Q

How to restrict multiple users to their own home directories

A

Change the /home to whichever directory you need the user should restricted to. Eg: ChrootDirectory /home/

Q

rsync error: protocol incompatibility (code 2) at /SourceCache/rsync/rsync-42/rsync/compat.c(61) [receiver=2.6.9] Any ideas? Thanks

A

I think its due to different versions of rsync installed on servers, make sure you have same version of rsync or may be different flavors of Linux distros used here, you need to check..

Q

Thanks for the article. I’m learning about SFTP now and was curious and wanted to know how to CHROOT its users from Centos 7.

A

You’re better of creating a SFTP root as /home/sftproot and then putting your SFTP users home directories under /home/sftproot/home. Then when that user logs in they’ll automatically get put

Q

is there any sftp command to use encrytion

A

follow this link : https://www.linuxhelp.com/sftp-command-transfer-encrypted-files/

Q

I meant I can not reach my odoo server locally anymore?

A

If you remove the 127.0.0.1 part and restart the server you will be able to run it locally on port 8069.

In this article I will share step by step guide on how to configure sftp server in Linux with examples covering the below topics in detail:

• Install sftp on Linux
• Configure sftp chroot
• Create sftp user/Create sftp group
• sftp restrict user to specific directory
• sftp chroot multiple directories

sftp is a file transfer program, similar to ftp, which performs all operations over an encrypted ssh transport. It may also use many features of ssh, such as public key authentication and compression.

Advertisement

Lab Environment

I have created two Virtual Machines with CentOS 8 on Oracle VirtualBox in Linux server. I will use these two Virtual Machines to configure and verify sftp restrict user to specific directory and sftp chroot multiple directories with examples. Most of the steps from this article should also work on other Linux distributions such as SuSE, Ubuntu etc, if you face any issues do let me know using the comment section from this page.

We will configure sftp chroot jail on

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

 server1server2Hostnameserver1.example.comserver2.example.comIP Address10.10.10.1410.10.10.13Setup SFTPas client
(which initiates sftp connection)as server
(sftp server)OSCentOS 8CentOS 8

ALSO READ: SOLVED: SSH fails with postponed publickey error

Step 1: Install sftp on Linux

On most Linux distributions

[root@server2 ~]# usermod --shell /bin/false deepak

[root@server2 ~]# usermod --shell /bin/false deepak

HINT:

Based on distribution

[root@server2 ~]# usermod --shell /bin/false deepak

[root@server2 ~]# usermod --shell /bin/false deepak

[root@server1 ~]# which sftp
/usr/bin/sftp

Step 2: Create SFTP User

I will create sftp user (

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

To create sftp user "

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# usermod --shell /bin/false deepak

Advertisement

[root@server2 ~]# useradd -m deepak

Check user details:

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

The user's home directory is owned by

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# ls -ld /home/deepak/
drwx------ 2 deepak deepak 4096 Mar 30 18:48 /home/deepak/

Assign password to sftp user deepak:

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

Change the shell of the sftp user to

[root@server2 ~]# usermod --shell /bin/false deepak

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

[root@server2 ~]# usermod --shell /bin/false deepak

Verify the user

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

HINT:

We could have also used

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

Step 3: Create SFTP Group (Optional)

In this article to demonstrate sftp restrict user to specific directory, I will use sftp user instead of sftp group. But if you have a requirement to implement group level sftp chroot jail then you can also create sftp group using below steps:

[root@server2 ~]# groupadd sftpusers   <-- Here group name is "sftpusers"

Add your user to this sftpusers group

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

ALSO READ:

How to add user to group or remove user from group (primary and secondary group)

Now you can use this group "

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

ALSO READ: How to create or configure NIC Teaming using nmcli (CentOS / RHEL 7/8)

Step 4: Configure SFTP chroot jail

To configure SFTP chroot jail we will modify

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

[root@server2 ~]# vim /etc/ssh/sshd_config

#Comment sftp-server SubSystem and use internal-sftp
#Subsystem       sftp    /usr/libexec/openssh/sftp-server
Subsystem       sftp    internal-sftp

#Add this section to match for user "deepak"
Match user deepak
        ChrootDirectory /opt/sftp-jails/deepak    <-- Our sftp chroot jail directory
        X11Forwarding no
        AllowTcpForwarding no
        PermitTunnel no
        AllowAgentForwarding no
        ForceCommand internal-sftp

HINT:

If you wish to configure sftp chroot jail for "

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

Here,

[root@server2 ~]# useradd -m deepak

Advertisement

Why we use internal-sftp instead of sftp-server for ChrootDirectory?

Collected from: OpenSSH: Difference between internal-sftp and sftp-server

• Both

  [root@server2 ~]# grep deepak /etc/passwd
  deepak:x:1003:1003::/home/deepak:/bin/false

  9 and

  [root@server2 ~]# grep deepak /etc/passwd
  deepak:x:1003:1003::/home/deepak:/bin/false

  8 are part of OpenSSH.

  [root@server2 ~]# grep deepak /etc/passwd
  deepak:x:1003:1003::/home/deepak:/bin/false

  9 is a standalone binary.

• [root@server2 ~]# grep deepak /etc/passwd
  deepak:x:1003:1003::/home/deepak:/bin/false

  8 is just a configuration keyword that tells sshd to use SFTP server code built-into sshd, instead of running another process (typically the

  [root@server2 ~]# grep deepak /etc/passwd
  deepak:x:1003:1003::/home/deepak:/bin/false

  9).

• [root@server2 ~]# grep deepak /etc/passwd
  deepak:x:1003:1003::/home/deepak:/bin/false

  9 is now redundant and is kept for a backward compatibility.
• The main advantage of

  [root@server2 ~]# grep deepak /etc/passwd
  deepak:x:1003:1003::/home/deepak:/bin/false

  8 is, that it requires no support files when used with

  [root@server2 ~]# groupadd sftpusers   <-- Here group name is "sftpusers"

  6 directive.
• Administrator may rely on a login shell configuration to prevent certain users from logging in.
• Switching to the

  [root@server2 ~]# grep deepak /etc/passwd
  deepak:x:1003:1003::/home/deepak:/bin/false

  8 would bypass the restriction, as the login shell is no longer involved.
• Using

  [root@server2 ~]# grep deepak /etc/passwd
  deepak:x:1003:1003::/home/deepak:/bin/false

  9 binary (being a standalone process) you can use some hacks, like running the SFTP under sudo.
• For SSH-1 (if anyone is still using it), Subsystem directive is not involved at all.
• An SFTP client using SSH-1 tells the server explicitly, what binary the server should run. So legacy SSH-1 SFTP clients have

  [root@server2 ~]# grep deepak /etc/passwd
  deepak:x:1003:1003::/home/deepak:/bin/false

  9 name hard-coded.

ALSO READ: Encode message in image with Steganography [Step-by-Step]

Next restart sshd service to activate sftp chroot jail configuration.

[root@server2 ~]# useradd -m deepak

Step 5: SFTP restrict user to specific directory (with password authentication)

Step 5.1: Create sftp chroot jail directories

If you wish to sftp restrict user home directory then you can ignore these steps and only use

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

In this article we will implement

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

[root@server2 ~]# useradd -m deepak

Step 5.2: Assign permissions on chroot jail directories

HINT:

The permissions you assign to sftp chroot directory may vary based on your requirement. The below is just for your reference to do a POC (Proof of Concept) on sftp restrict user to specific directory. You may get "

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

Our sftp user

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

Advertisement

[root@server2 ~]# useradd -m deepak

It is mandatory to have the user and group owner set to root:root with 755 permission for the chroot directory provided in

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

ALSO READ: Configure secure logging with rsyslog TLS to remote log server (CentOS/RHEL 7)

From the man page https://man.openbsd.org/sshd_config

ChrootDirectory Specifies the pathname of a directory to chroot(2) to after authentication. At session startup sshd(8) checks that all components of the pathname are root-owned directories which are not writable by any other user or group.

User will have no write permission on

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

[root@server2 ~]# vim /etc/ssh/sshd_config

#Comment sftp-server SubSystem and use internal-sftp
#Subsystem       sftp    /usr/libexec/openssh/sftp-server
Subsystem       sftp    internal-sftp

#Add this section to match for user "deepak"
Match user deepak
        ChrootDirectory /opt/sftp-jails/deepak    <-- Our sftp chroot jail directory
        X11Forwarding no
        AllowTcpForwarding no
        PermitTunnel no
        AllowAgentForwarding no
        ForceCommand internal-sftp

[root@server2 ~]# useradd -m deepak

As you see the user directory is owned by root with 755 permission to allow user

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# vim /etc/ssh/sshd_config

#Comment sftp-server SubSystem and use internal-sftp
#Subsystem       sftp    /usr/libexec/openssh/sftp-server
Subsystem       sftp    internal-sftp

#Add this section to match for user "deepak"
Match user deepak
        ChrootDirectory /opt/sftp-jails/deepak    <-- Our sftp chroot jail directory
        X11Forwarding no
        AllowTcpForwarding no
        PermitTunnel no
        AllowAgentForwarding no
        ForceCommand internal-sftp

We will change user owner to

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# useradd -m deepak

Also change the permission to 750 to restrict others from writing in this

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

Advertisement

[root@server2 ~]# useradd -m deepak

Verify the permission:

[root@server2 ~]# useradd -m deepak

Below is the tree structure of the directories we have created to configure sftp restrict user to specific directory

[root@server2 ~]# useradd -m deepak

Step 5.3: Verify SSH and SFTP connectivity and permissions

Since we have blocked ssh access for our sftp user

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# useradd -m deepak

As expected we are getting "

[root@server2 ~]# vim /etc/ssh/sshd_config

#Comment sftp-server SubSystem and use internal-sftp
#Subsystem       sftp    /usr/libexec/openssh/sftp-server
Subsystem       sftp    internal-sftp

#Add this section to match for user "deepak"
Match user deepak
        ChrootDirectory /opt/sftp-jails/deepak    <-- Our sftp chroot jail directory
        X11Forwarding no
        AllowTcpForwarding no
        PermitTunnel no
        AllowAgentForwarding no
        ForceCommand internal-sftp

ALSO READ: How to download rpm package and all dependencies (RHEL / CentOS 7)

Step 5.4: Assign SFTP umask (Optional but Important)

Most of us miss the umask configuration while setting up SFTP and this can become a big issue later and hard to debug. By default SFTP follows the umask of the server node for any PUT operation. So for example you are trying to upload a file with permission 644 on the source client while the SFTP server has umask 027. Once you perform PUT operation to this SFTP server, the file permission will automatically become 640 due to umask 027.

Advertisement

So, umask will trim down any additional permission from the files uploaded to the SFTP server.

If you wish to provide a custom umask for SFTP PUT operation then modify

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

TO

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

For Example to use sftp umask of 022 we can add:

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

Restart sshd service to activate the changes.

Now any file uploaded will have atleast 644 permission.

HINT:

You have to understand one more thing, if the source file permission is 640 then setting umask to 022 will not add additional read permission to others. umask is used only to trim down additional permission. So you have to make sure that the file permission for the files to be uploaded on SFTP server is inline to your requirement.

ALSO READ: Limit CPU with cgroups & slice in Linux [100% Working]

How to fix packet_write_wait: Connection to X.X.X.X port 22: Broken pipe?

It is possible that if your configuration has some issues, you will get "

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# vim /etc/ssh/sshd_config

#Comment sftp-server SubSystem and use internal-sftp
#Subsystem       sftp    /usr/libexec/openssh/sftp-server
Subsystem       sftp    internal-sftp

#Add this section to match for user "deepak"
Match user deepak
        ChrootDirectory /opt/sftp-jails/deepak    <-- Our sftp chroot jail directory
        X11Forwarding no
        AllowTcpForwarding no
        PermitTunnel no
        AllowAgentForwarding no
        ForceCommand internal-sftp

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

Now this error does not gives much detail of the underlying problem but this is seen mostly due to permission issues.

So in such case we must check

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# useradd -m deepak

Using

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

Now this error "

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

From the man page of sshd_config for

[root@server2 ~]# groupadd sftpusers   <-- Here group name is "sftpusers"

So you can validate the permission you have provided for your chroot directory to fix "

[root@server2 ~]# usermod --gid sftpusers deepak  <-- Adding user "deepak" to group "sftpusers"

Next attempt SFTP communication from

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

ALSO READ: How to install Caine 11.0 VM [Step-by-Step]

Step 6: Setup passwordless sftp authorized_keys

In the above example we configured sftp restrict user to specific directory where user authenticates itself using password. You may face issues when you try to use sftp chroot jail in script to automate some tasks as every time sftp communication will prompt for user password.

In this example we will setup passwordless sftp authorized_keys between our servers to sftp restrict user to specific directory.

Step 6.1: Create sftp authorized_keys file

On

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# useradd -m deepak

HINT:

You can use any path to create your sftp

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

Create a hidden directory

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

The .ssh directory must be owned by

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

Create sftp

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# id deepak
uid=1003(deepak) gid=1003(deepak) groups=1003(deepak)

Change ownership and permission of this file

[root@server2 ~]# ls -ld /home/deepak/
drwx------ 2 deepak deepak 4096 Mar 30 18:48 /home/deepak/

Verify the permissions:

[root@server2 ~]# ls -ld /home/deepak/
drwx------ 2 deepak deepak 4096 Mar 30 18:48 /home/deepak/

ALSO READ: Show NFS shares | List NFS mount points | List NFS clients Linux

Step 6.2: Generate SSH key pair to setup passwordless sftp

We are creating key pair using root user without using any password to sftp restrict user to specific directory. The private public key pair will be created under the home folder of root user inside

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# ls -ld /home/deepak/
drwx------ 2 deepak deepak 4096 Mar 30 18:48 /home/deepak/

Copy the content of your public key

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# useradd -m deepak

ALSO READ:

How login to Linux server works without password (with private and public key pair)?

[root@server2 ~]# ls -ld /home/deepak/
drwx------ 2 deepak deepak 4096 Mar 30 18:48 /home/deepak/

Step 6.3: Setup sftp chroot jail with authorized_keys

In your existing sftp chroot jail configuration of

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# ls -ld /home/deepak/
drwx------ 2 deepak deepak 4096 Mar 30 18:48 /home/deepak/

Restart sshd service to activate the sftp

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# useradd -m deepak

Below is a tree structure of our sftp chroot jail directory with all the permissions:

[root@server2 ~]# ls -ld /home/deepak/
drwx------ 2 deepak deepak 4096 Mar 30 18:48 /home/deepak/

Step 6.4: Verify SFTP connectivity and permissions

Perform sftp connection from

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# ls -ld /home/deepak/
drwx------ 2 deepak deepak 4096 Mar 30 18:48 /home/deepak/

So our passwordless sftp

[root@server2 ~]# useradd -m deepak

Step 7: Setup SSH client for passwordless sftp

By default when you do sftp, the tool looks under the home folder of the user for any available passphrase to perform passwordless sftp. In our case since the private key exists inside root's home folder the SFTP passwordless worked flawlessly.

ALSO READ: Windows Subsystem for Linux (WSL2) on Windows 10 (Step-by-Step)

But if you attempt to use any other user for sftp passwordless connection then it would fail. Below I try to do sftp using

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# ls -ld /home/deepak/
drwx------ 2 deepak deepak 4096 Mar 30 18:48 /home/deepak/

As you see the sftp communication is prompting for password and passwordless sftp authorized_keys is not working.

To overcome this restriction for sftp restrict user to specific directory without password we have two solutions:

Solution 1: Perform passowrdless sftp with private key

You must define the private key you want to use for performing sftp communication to perform passwordless sftp. For example:

I will copy the private key I generated under a path which is accessible by user

[root@server2 ~]# useradd -m deepak

I created a temporary directory

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# ls -ld /home/deepak/
drwx------ 2 deepak deepak 4096 Mar 30 18:48 /home/deepak/

Copy the private key from to this location and make it readable by all users of

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

Next attempt to perform passwordless sftp to

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

Solution 2: Create ssh config file for individual user

We can also create a local ssh config file for individual user of the node to perform passwordless sftp to

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# useradd -m deepak

You can check the permissions and ownership I have assigned for all the files and directories under

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

Below is the content of

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# useradd -m deepak

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

Next verify the passwordless sftp communication

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

ALSO READ: 4 different MITM Attacks with Xerosploit [Step-by-Step]

Step 8: SFTP chroot multiple directories

Similar to the

[root@server2 ~]# useradd -m deepak

For example in the below configuration from

[root@server2 ~]# grep deepak /etc/passwd
deepak:x:1003:1003::/home/deepak:/bin/false

[root@server2 ~]# passwd deepak
Changing password for user deepak.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

All other steps from this article would be the same to sftp chroot multiple directories, you just have to take care of user and group permission on individual sftp chroot jail directories

Lastly I hope the steps from the article to configure sftp and setup sftp restrict user to specific directory, sftp chroot multiple directories on RHEL/CentOS 7/8 Linux was helpful. So, let me know your suggestions and feedback using the comment section.

Related Searches: could not chdir to home directory, configure sftp centos, sftp user permissions, sctp chroot tutorial, how to configure sftp server in linux step by step, create linux user with limited access to one folder only, sftp server linux redhat

How to set SFTP home directory?

How to configure an SFTP server with restricted chroot users with SSH keys?

How to chroot a SFTP user?

How to check SFTP configuration in Linux?