infra-phytron/server/phy-z-dmz-sftp01/notes/20260130-sftp-config.md

Base

• ssh hardening
• fail2ban
• autoupdate

User and Groups

• Group: sftpusers
• User: sftpuser (default) (sudo useradd -G sftpusers -s /sbin/nologin sftpuser)
• Path: /home/sftpuser for user key file

Notes

• each user needs pub keys set in its home path /home/<user>/.ssh/authorized_keys
• each user will be logged on to the sftp path /sftp
• the default sftpuser has as shell /sbin/nologin so that it can not login via ssh
• each user needs to be in the group sftpusers for sftp access.
• users in the sftpusers group can not login via ssh
• created group admins for ssh access. Only via Pub Key auth