Recently we're asked to set up a new OS in VMware and grant FTP access (for onsite and offsite both). FTP was widely used for such requests however it had one major flaw. All data including login details were transmitted in plain text. So do avoid the malicious activity / attack, FTPS was introduced. It is basically FTP Protocol with added encryption using SSL. However, it still works on FTP protocol.
There is a new and better technique used now a days called SFTP. It is a subsystem of SSH protocol. What is interesting is it does not use FTP in any way nor does it require any kind of FTP software (like vsftpd) for it to function.
However, in order to use SFTP you must have OpenSSH version 5 or newer installed. You can find you ssh version by -
$ ssh -V
OpenSSH_5.8p2, OpenSSL 1.0.0j-fips 10 May 2012
With the basic implementation of SSH if a user logs in they are dropped in their home directory. With a few basic commands (cd /) they can back out of their home directory and into the root directory. To stop this and confine a user to their home directory we chroot the user. The act of locking or confining a user to a certain directory is called chroot or chrooting, which means "to change the root directory". Chrooting a user will for all intents and purposes change their root directory to their home directory. They will not be able to back out of the directory.
To begin we will need to edit the /etc/ssh/sshd_config and set the following options:
$ vi /etc/ssh/sshd_config
Subsystem sftp internal-sftp
Match Group sftp
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no
Now let's create the sftp group, create a user, create a password for that user and add them to the sftp group.
$ groupad sftp
$ useradd nitish
$ passwd nitish
$ usermod -G sftp nitish
$ id nitish
uid=502(nitish) gid=502(nitish) groups=502(nitish),503(sftp)
Now, we need to take away the shell access for user "nitish" so he can only SFTP and SCP.
$ usermod -s /bin/false nitish
Now, lock the user "nitish" into his home directory. Change the ownership of their home directory to root and set permissions.
$ chown root:root /home/nitish
$ chmod 0755 /home/nitish
Above dir. modifications are required for a secure chroot. But this limits what user "nitish" can do, for example with the current setup the user "nitish" will be able to log in, but not be able to create a directory or upload any files. So now make a new directory inside this user "nitish" home directory which is owned by him.
$ mkdir /home/nitish/nitish_directory
$ chown nitish /home/nitish/nitish_directory
The above command will allow the user "nitish" Full access to "nitish_directory" to upload, download, and create more directories inside. But it will also limit access to his home directory (which becomes his root directory).
All Done!!!!
There is a new and better technique used now a days called SFTP. It is a subsystem of SSH protocol. What is interesting is it does not use FTP in any way nor does it require any kind of FTP software (like vsftpd) for it to function.
However, in order to use SFTP you must have OpenSSH version 5 or newer installed. You can find you ssh version by -
$ ssh -V
OpenSSH_5.8p2, OpenSSL 1.0.0j-fips 10 May 2012
With the basic implementation of SSH if a user logs in they are dropped in their home directory. With a few basic commands (cd /) they can back out of their home directory and into the root directory. To stop this and confine a user to their home directory we chroot the user. The act of locking or confining a user to a certain directory is called chroot or chrooting, which means "to change the root directory". Chrooting a user will for all intents and purposes change their root directory to their home directory. They will not be able to back out of the directory.
To begin we will need to edit the /etc/ssh/sshd_config and set the following options:
$ vi /etc/ssh/sshd_config
Subsystem sftp internal-sftp
Match Group sftp
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no
Now let's create the sftp group, create a user, create a password for that user and add them to the sftp group.
$ groupad sftp
$ useradd nitish
$ passwd nitish
$ usermod -G sftp nitish
$ id nitish
uid=502(nitish) gid=502(nitish) groups=502(nitish),503(sftp)
Now, we need to take away the shell access for user "nitish" so he can only SFTP and SCP.
$ usermod -s /bin/false nitish
Now, lock the user "nitish" into his home directory. Change the ownership of their home directory to root and set permissions.
$ chown root:root /home/nitish
$ chmod 0755 /home/nitish
Above dir. modifications are required for a secure chroot. But this limits what user "nitish" can do, for example with the current setup the user "nitish" will be able to log in, but not be able to create a directory or upload any files. So now make a new directory inside this user "nitish" home directory which is owned by him.
$ mkdir /home/nitish/nitish_directory
$ chown nitish /home/nitish/nitish_directory
The above command will allow the user "nitish" Full access to "nitish_directory" to upload, download, and create more directories inside. But it will also limit access to his home directory (which becomes his root directory).
All Done!!!!
