Configure caged SFTP server with write permissions in the GNU/Linux group

In this entry we will perform a caged SFTP configuration in which both the owner and the group will be able to make modifications to the caged directory.

We made this modification since in my case a user who manages an application needs to be able to process the files hosted in the SFTP.

User and directory configuration

We create the group

groupadd sftp

We create the user and add it to the sftp group

useradd -g sftp -s /bin/false -d /home/usersftp/ usersftp

We assign a password to the user

passwd usersftp

We create the folder structure and assign the corresponding permissions

mkdir -p /home/usersftp/public/response
mkdir -p /home/usersftp/public/request
mkdir -p /home/usersftp/public/.processed
chmod 755 /home/usersftp/public/.processed
chown root:root /home/usersftp/
chown usersftp:sftp /home/usersftp/public/*

We access the directory where the files will be transferred

cd /home/usersftp/public

We assign the following permissions and ACLs for the group to have permissions:

chmod -R g+srwX response/

chmod -R g+rwX request/

chmod -R g+rwX .processed/
chown -R :sftp response/

chmod -R g+s response/

setfacl -d -m g::rwx response
chown -R :sftp request/

chmod -R g+s request/

setfacl -d -m g::rwx request
chown -R :sftp .processed/

chmod -R g+s .processed/

setfacl -d -m g::rwx .processed

We add to the end of the file .bashrc of the user that we want to access the following line:

cat /home/rokitoh/.bashrc

umask 002

We add the user to the corresponding group

usermod -a -G sftp rokitoh

SSH Configuration

We add to the file /etc/pam.d/sshd the following line at the end:

session optional pam_umask.so umask=0002

We access /etc/ssh/sshd_config and we must modify the following line:

Subsystem sftp /usr/lib/openssh/sftp-server

For this:

Subsystem sftp /bin/sh -c ‘umask 0002; /usr/lib/openssh/sftp-server’

We also have to add the following configuration to the end of the file:

Match user users ftp
ChrootDirectory %h
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp -u 2
KbdInteractiveAuthentication yes

We restart the ssh service

service sshd restart

We try to access the server using our ftp client and create a file.

Also using the user that we have configured in the sftp group (in my case rokitoh) I could now create or modify a file on the sftp server using a shell.

All the best

:wq!