6

I am trying to configure a SFTP server for some automated backups. I configured an Ubuntu 14.04 server and have had partial success. The idea I'm looking to do is this:

  1. A user will be created for each particular system to be backed up. SFTP only.
  2. The user will be Chrooted and not be able to read or write outside their home directory.
  3. The user's home will be the "root" once logged in.
  4. The user will be able to upload files to the root. (This is where I'm stuck.)

I used the following snippet to create the Chroot in sshd_config like this:

Match Group sftpbackup ChrootDirectory /srv/sftpbackup/%u X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp

Then I set the permissions on /srv/sftpbackup as per the requirements.

# ls -l total 4 drwxr-x--- 3 root sftpbackup 4096 Jan 5 15:29 user1 #

Now, the user can login but cannot upload files (Permission Denied). If I change the directory ownership to look like this:

# ls -l total 4 drwxrwx--- 3 user1 sftpbackup 4096 Jan 5 15:29 user1 #

Then the user cannot login, from auth.log:

sshd[14835]: fatal: bad ownership or modes for chroot directory "/srv/sftpbackup/user1"

It seems like, if the user's home directory is the SFTP chroot, root must own the directory, thus a subdirectory must be created so that the user can write to it.

Is there anyway to make the root writeable? Looking at various websites, it appears that there is no way to achieve what I want. I don't quite understand though what the difference is between having the chroot dir writeable by the user and having a subdirectory writeable. Insights would be appreciated.

Note: My goal is to create a server where backups can be stored by various devices. The devices will be configured by a third-party vendor, thus I'm trying to keep things as simple (one user name per device, all files go to the "root" once logged in) and secure (the users created will have minimal rights to the server) as possible. Apologies if my desires are a bit rigid.

Improve this question

1 Answer 1

Reset to default
4

Internal-sftp require chrooted user home to reside inside root-owned dir:

/some/path/root-owned/user-dir1 /user-dir2

Root-owned dir should have 555 permissions and user-dirs should be created by root and owned by specific user. Inside subdirs user can do anything, but he can't delete or rename user-dir[12].

This is internal-sftp restrictions.

Improve this answer
3
  • 1
    This answer is incorrect! The actual chrooted user home should be root owned, not just the directory in which that user home resides! So in this example, both user-dir1 and user-dir2 must be root owned in order to be chroot targets. Commented Mar 14, 2022 at 18:25
  • @Frans I mean that /some/path/root-owned/ should be home for chrooted user. While user-dir1 and user-dir2 are the dirs c/user have RW permissions inside. C/user can do anything inside that dirs but can't delete them and can't create another dirs or files in his home dir. Commented Mar 14, 2022 at 21:46
  • 2
    Yes, but that doesn't satisfy the OP's requirement 4 which is that the user should be able to write to the root of his chroot jail - I think the only answer is that this is not possible with OpenSSH. Commented Mar 15, 2022 at 10:28

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.