Ezio Ruan's Blog

Life is Strange

0%

setup sftp account and two differences authentication logins

Posted on Edited on

sftp is a way to use ftp on a linux server. it use the ssh account to connect the server, we can setup the sftp account and provide differences authentication

create sftp account without shell permission

1
sudo adduser --shell /bin/false sftpuser

then set the password for the user

1
sudo passwd sftpuser

create sftp directory for the user, and give the permission

/var/sftp/files here

1
2
3
4
5
6
sudo mkdir -p /var/sftp/files
sudo chown sftpuser:sftpuser /var/sftp/files

sudo chown root:root /var/sftp
sudo chmod 755 /var/sftp

create public key

we need to create the files in the user’s home directory, and generate the authentication keys

1
mkdir /home/sftpuser/.ssh

generate keys by ssh-keygen -t rsa and point the file location to /home/sftpuser/.ssh/id_rsa

set authorized keys and permission

1
2
3
4
5
6
cd .ssh
touch authorized_keys
cat id_rsa.pub >> authorized_keys
cd ..
chmod 700 .ssh
chmod 600 .ssh/authorized_keys

save the generate private key to your compucter and give 600 permission

1
2
cat /home/sftp/.ssh/id_rsa > sftp.pem
chmod 600 sftp.pem

update sftp user config to enable password and public key authentication

edit file at /etc/ssh/sshd_config, append below lines

1
2
3
4
5
6
7
8
9
10
11
Match User sftpuser
	ForceCommand internal-sftp
	PasswordAuthentication yes
	ChrootDirectory /var/sftp
	PermitTunnel no
	AllowAgentForwarding no
	AllowTcpForwarding no
	X11Forwarding no
	RSAAuthentication yes
	PubkeyAuthentication yes
	AuthorizedKeysFile /home/sftpuser/.ssh/authorized_keys

set PasswordAuthentication to yes to enable password authentication,
set PubkeyAuthentication to yes to enable public key authentication,

and then restart sshd services
sudo service sshd restart

test sftp connection by command line

password authentication

1
sftp  sftpuser@<server_host>

public key authentication

1
sftp -i sftp.pem sftpuser@<server_host>