63 lines
1.9 KiB
Markdown
63 lines
1.9 KiB
Markdown
# Add new Users to SFTP Server
|
|
|
|
## Introduction
|
|
|
|
We configured a SFTP server with a shared chroot jail and such that the server can only be authenticated via public key exchange.
|
|
|
|
The shared SFTP root folder is at `/sftp`:
|
|
```bash
|
|
root@z-sftp-01:~# ls -al /sftp/
|
|
total 16
|
|
drwxr-xr-x 4 root root 4096 Jan 30 15:16 .
|
|
drwxr-xr-x 19 root root 4096 Feb 4 00:00 ..
|
|
drwxrwx--- 2 root sftpusers 4096 Jan 30 15:47 data
|
|
drwxrwx--- 2 root sftpusers 4096 Jan 30 15:23 uploads
|
|
```
|
|
|
|
The server can only be reached via sftp by users which are members of the `sftpusers` group; while these users are not able to login via ssh. Only users which are in `admins` group can access the server via ssh and this also only via public key authentication.
|
|
|
|
|
|
## New User
|
|
|
|
|
|
### User Creation
|
|
|
|
We create the user on the server:
|
|
|
|
```bash
|
|
useradd -m -s /sbin/nologin <username>
|
|
```
|
|
|
|
The option `-m` explicitly creates a home folder (under `/home`) for the user which is not created when using the option `-s` and giving the user the `/sbin/nologin` shell.
|
|
|
|
And add the user to the correct group:
|
|
|
|
```bash
|
|
usermod -aG sftpusers <username>
|
|
```
|
|
|
|
### SSH authentication
|
|
|
|
Create a ssh key pair for the user with the command,
|
|
|
|
```bash
|
|
ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/<sbx-sftp-name> -C <user-mail>
|
|
```
|
|
which can be done in an arbitrary Unix shell supporting `ssh-keygen`.
|
|
|
|
In order for the user to be able to authenticate via public key exchange we have to create a `/home/<username>/.ssh/authorized_keys` file with proper permissions:
|
|
|
|
```bash
|
|
mkdir /home/<username>/.ssh
|
|
touch /home/<username>/.ssh/authorized_keys
|
|
chown -R <username>:<username> /home/<username>/.ssh
|
|
chmod 700 /home/<username>/.ssh
|
|
chmod 600 /home/<username>/.ssh/authorized_keys
|
|
```
|
|
|
|
Take the content of the public key file an insert into the proper authorized_key file
|
|
|
|
```bash
|
|
cat ~/.ssh/<sbx-sftp-name>.pub | tee -a ~/.ssh/authorized_keys
|
|
```
|