Caged SFTP

1. Introduction

Caging is a technique by which the user is given limited access to the Linux file system. Normally caging is done within each user's home and access is limited to it, so that the root directory for a caged user / corresponds to the real home directory /home/user of the file system.

SFTP or SSH File Transport Protocol SSH File Transfer Protocol (sometimes called Secure File Transfer Protocol or SFTP) is a network protocol that provides file transfer and manipulation functionality over any trusted data stream. It is typically used with version two of the SSH protocol (TCP port 22) to provide secure file transfer, although it is intended to be used with other protocols as well.

OpenSSH was created as an open source alternative to the proprietary Secure Shell software suite offered by SSH Communications Security. It is developed as part of the OpenBSD project.
Telnet, rlogin, and ftp users cannot have their password transmitted encrypted over the Internet. OpenSSH encrypts all traffic (including password) to eliminate connection eavesdropping, hacking, and other attacks. Additionally, OpenSSH provides tunneling capabilities and various authentication methods and supports all versions of the SSH protocol.

This tutorial is valid from version 4.8p1 of the openssh-server port on GNU/Linux (see References).
2. OpenSSH installation

Install the OpenSSH package contained in the Debian repositories, running the following:

# aptitude install openssh-server

# aptitude install openssh-client

With this, system users will be able to log in via SFTP, but be careful, if the configuration is left this way, users will be able to navigate through the entire system, thus risking the confidentiality of other users and the system itself. To prevent this from happening, OpenSSH can be configured in such a way that the user can connect to the server but caged in its directory. This means that you will have access only to the directory where your data is and will not be able to go above this level.
3. Creating a user group with SFTP access

To exemplify the configuration, a group and a user are created in the system, in addition to their directories as follows:
manner.

Create a cage directory for the ftpusers group and a cage directory for the user user1 specifically:

# mkdir /home/usuariossftp

# mkdir /home/usuariossftp/usuario1

Change the directories permissions to 755 with the following commands:

# chmod 755 /home/usuariossftp

# chmod 755 /home/usuariossftp/usuario1

Create the group sftpusers and the user user1 as follows:

# groupadd usuariossftp

# useradd -g usuariossftp -s /bin/false -d /home/usuariossftp/usuario1 usuario1

# passwd usuario1

And I added a folder inside user1's 'home' so that he can upload his files:

# mkdir /home/usuariossftp/usuario1/archivos

# chown usuario1:usuariossftp /home/usuariossftp/usuario1/archivos

4. Configuración del enjaulado SFTP

To configure a restricted SFTP server one should use the directives ForceCommand and ChrootDirectory in the configuration file sshd_config, which is found in /etc/ssh/sshd_config.

First you have to change, the line in /etc/ssh/sshd_config,

Subsystem sftp /usr/lib/openssh/sftp-server

writing instead:

Subsystem sftp internal-sftp

The service can be restricted to users or groups of users, so if it is required to apply caging to user1 we use the Match directive as follows:

.

.

UsePAM yes

Match user usuario1

ChrootDirectory /home/usuariossftp/usuario1

ForceCommand internal-sftp

For group caging ftpusers It is done in a similar way (this way all the users we have created will appear in the root directory):

.

.

Match group usuariossftp

ChrootDirectory /home/usuariossftp

ForceCommand internal-sftp

Thus, all users belonging to this group will go to the cage specified in ChrootDirectory.

For the configuration to take effect, reset ssh with the command:
# /etc/init.d/ssh restart
5. Permits and cage owners

For caging via SFTP to occur, the owner of the cage directory and the directories above it must be root. So for this example, the folders /home, /home/sftpusers and /home/sftpusers/user1 must be owned by root with permissions 755. This is a restriction of the ChrootDirectory in OpenSSH.

If we left the previous configuration this way, the user would not have writing privileges over their directory. To solve this problem, the 'files' directory is created for the user, within the cage, which is their property, and it is there where they can both write and read their files.
6. Other settings

Other configurations help maintain the security of the system against possible malicious access by unauthorized users. Some of these are:

Reduce the authentication time to a lower value, in this case to 30 seconds and restrict access to the root user. This is done in the authentication section of the /etc/ssh/sshd_config file:
LoginGraceTime 30
PermitRootLogin no

Only some users or groups of users can be allowed access with the AllowUsers and AllowGroups policies respectively, listing the users or groups that will be allowed access after the policies. Just as you can allow access only to specific users and groups with the previous policies, you can deny access to users and groups with the DenyGroups and DenyUsers policies.

The security of the system in access via SFTP can be improved by making various configurations in the /etc/ssh/sshd_config file; to do so, consult the manual page referenced here.
7. References
http://www.openssh.com/
http://en.wikipedia.org/wiki/SSH_file_transfer_protocol
http://undeadly.org/cgi?action=article&sid=20080220110039
http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config
www.favshare.com/es/pdf/servidores…/enjaulado-SFTP.pdf
http://www.esdebian.org/foro/32577/como-enjaulo-usuarios-cargarse-via-…
http://www.debian-administration.org/articles/590

Source: http://www.esdebian.org/wiki/enjaulado-sftp