SFTP with multiple users with RSA

[Mykle87]

I have been thinking a lot of ssh/sftp recently as you could tell by my recent thread (http://ubuntuforums.org/showthread.php?t=1115472). I want to outline my ideal setup to see if it is at all possible. Please share your thoughts with me.

I want to have an Ubuntu Server box with openssh installed. I want to be able to have full access to the box with my username. I want to have 1 or 2 other users to only have sftp access. I found this chrooted ssh/sftp tutorial (http://www.howtoforge.com/chrooted-ssh-sftp-tutorial-debian-lenny) that should solve the users restriction issue. The next step is security. I like the idea of having a RSA key to keep my system and network fully secured. I want my username to use a RSA key plus passphrase and I want the other users to have a separate RSA without passphrases. Is this even possible? If I give some friends a RSA key, will they be able to log in under my username? How could I securely give them the key over the internet? Would a RSA key be too difficult for my end users who do not have high computer skills? Is this setup too complex?

This will turn into a fun little summer project for me. I want this box to be a home server for sharing media on the lan and using it as a sort of "thumb drive" on the internet. I'm sure I will create other threads to address some other server functions but I will get to that when the time comes. Everyone's thoughts are greatly appreciated.

[spiderbatdad]

what you want to do is possible. You'll probably want to set up a login group and of course the user accounts...these get set in sshd_config

The RSA keys should be generated by the computers and uploaded to the server from each computer. I usually temporarily turn on password login in sshd_config for this, then disable password logins again, after the key is uploaded. Each time a change is made in the sshd_config file, like enabling/disabling password login, the server needs to be restarted.
The command is:
ssh-copy-id -i ~/.ssh/id_rsa.pub username@ip.address this is run from the client prior to login and assumes a unix type file system where the key resides in the clients home directory in the folder .ssh/
Use add addgroup command to create a group of users allowed to login sudo addgroup --gid 450 sshlogin
Use the adduser command to add user names to the group sshloginsudo adduser username sshlogin

These two guides tell a lot more:
https://help.ubuntu.com/community/AdvancedOpenSSH
https://help.ubuntu.com/community/SSHHowto

[Mykle87]

Thanks for the reply spiderbatdad. I would prefer not to create multiple keys for each username at everyones computer because my potential users are my girlfriend, sister, and friends. Would you recommend having one username for these people and me setting up the RSA keys and then sending the RSA key over aim and telling them the login info? Also, where does the RSA private key go on the clients computer?