Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 24

Thread: FTP Users problem

  1. #11
    Join Date
    Nov 2012
    Beans
    38

    Re: FTP Users problem

    I can't make this this way...

    Can you explain me how I can chroot ssh users to his home directory? And allow sftp chrooted to their home folder.

    And if I make this, they can execute scripts and servers?

  2. #12
    Join Date
    Sep 2006
    Beans
    7,690
    Distro
    Lubuntu Development Release

    chrootdirectory /home

    There is one trouble with chrooting users to their home directories, the chroot target has to be owned by root and not writable by anyone else. So if you have fairly static content in the home directories, you can do that and still leave all the files and subdirectories under the ownership of the user. Otherwise, if you can't chown the home directories you can still point them to /home instead.

    So if you can chown the home directory to root, then you could do it like this:

    Code:
    Subsystem sftp internal-sftp
    
    Match Group users
            ChrootDirectory %h
            AllowTCPForwarding no
            X11Forwarding no
            ForceCommand internal-sftp
    %h gets substituted with the actual home directory of the user logging in.

    Otherwise, you can point them to /home and them have them cd to their directory.

    Code:
    Subsystem sftp internal-sftp
    
    Match Group users
            ChrootDirectory /home
            AllowTCPForwarding no
            X11Forwarding no
            ForceCommand internal-sftp
    Last edited by Lars Noodén; May 26th, 2013 at 07:20 PM.

  3. #13
    Join Date
    Nov 2012
    Beans
    38

    Re: FTP Users problem

    Ok, but how i can allow ssh connection?

    And if they are chroot they can acess the linux system folders and things like that to execute the game server on that account?

  4. #14
    Join Date
    Sep 2006
    Beans
    7,690
    Distro
    Lubuntu Development Release

    Chroot ssh

    The interactive SSH connection is harder to chroot, even if SFTP is easy. If you want to allow interactive login to a chrooted directory, you need to include at least a shell (e.g. bash) and basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4), arandom(4) and tty(4) devices. It requires a bit of setting up, then they can only access the files and programs within the chroot. What are you trying to arrange?

  5. #15
    Join Date
    Nov 2012
    Beans
    38

    Re: FTP Users problem

    I have a VPS when I need to create 2 users, one for minecraft other for SAMP. (2 different games)

    Each account will have a folder with the game files inside.

    Now the Minecraft guy needs to acess via FTP the account minecraft to update files and needs SSH to execute the scripts in order to start the server.
    The same for SAMP guy.

    But I want to block acess outside each ubuntu account (Minecraft/SAMP). Only give access to his home folder.

    I'm working on this 3 days and I can't solve the situation :s

  6. #16
    Join Date
    Nov 2012
    Beans
    38

    Re: FTP Users problem

    If i block SSH to an ip SFTP will be blocked to that ip too?

  7. #17
    Join Date
    Sep 2006
    Beans
    7,690
    Distro
    Lubuntu Development Release

    rbash

    I was at first thinking changing their shells to /bin/rbash and doing some tricks with the $PATH but after doing a little experimenting, it might be doable with restricted keys. They need to run SFTP and one script, right?

    If that is the case, you can make two keys for each user, one to run SFTP one to run a script. If you have several scripts, you need one key per script. Make two or more keys (using strong passphrases) for each user, then make sure they can log in with those keys. Once that is in place, log into the server and edit their ~/.ssh/authorized_keys files on the server and prepend forced commands to each key. One command will be for the script the other will be to force sftp.

    Code:
    command="/usr/local/bin/somescript"  ssh-rsa AAAAB3NzaC1yc2EAAAA....
    command="/usr/lib/openssh/sftp-server" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCi+k1d0agqW...
    Then on the client workstation the script can be launched like this:

    Code:
    ssh -i ~/.ssh/script_rsa_key user@server.example.org
    And sftp launched like this (of several ways).

    Code:
    sftp -i ~/.ssh/sftp_rsa_key user@server.example.org

  8. #18
    Join Date
    Sep 2006
    Beans
    7,690
    Distro
    Lubuntu Development Release

    Re: FTP Users problem

    Quote Originally Posted by Di0g0 View Post
    If i block SSH to an ip SFTP will be blocked to that ip too?
    If you block SSH with iptables (firewall) then SFTP will be blocked, too. If you want only SFTP but not SSH , see the trick above.

  9. #19
    Join Date
    Nov 2012
    Beans
    38

    Re: FTP Users problem

    Here the client put this? Putty? ssh -i ~/.ssh/script_rsa_key user@server.example.org

    Ya they only need to run a file to start the server ahhh an another to stop the serve, in the SAMP case the only way to stop the server is killing the PID :s

  10. #20
    Join Date
    Sep 2006
    Beans
    7,690
    Distro
    Lubuntu Development Release

    Re: FTP Users problem

    Quote Originally Posted by Di0g0 View Post
    Here the client put this? Putty? ssh -i ~/.ssh/script_rsa_key user@server.example.org
    PuTTY should do everything you need as far as connecting goes, but I haven't used it on Linux. Is there an Ubuntu version?

    I would try to set everything up from Linux first and then load the keys into PuTTY. Here's one tutorial how:

    http://www.howtoforge.com/ssh_key_based_logins_putty

    But it will only work after you have the keys ready.

Page 2 of 3 FirstFirst 123 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •