Configure caged SFTP server with bind mounts

In this entry we will perform a caged SFTP configuration in which it will be mounted via BIND on another route.

User and directory configuration

We create the group

groupadd sftp

We create the user and add it to the sftp group

useradd -g sftp -s /bin/false -d /home/usersftp/ usersftp

We assign a password to the user

passwd usersftp

We create the folder structure and assign the corresponding permissions

mkdir -p /home/usersftp/public/
chown root:root /home/usersftp/
chown usersftp:sftp /home/usersftp/public/

We create the directory where we are going to mount the file system using bind

mkdir -p /var/www/html/sftp

We add the fstab file to the following line and mount the file system

echo ‘ /var/www/html/sftp /home/usersftp/public/ none bind 0 0’ >> /etc/fstab
mount /home/usersftp/public/

SSH Configuration

We access /etc/ssh/sshd_config and we must modify the following line:

Subsystem sftp /usr/lib/openssh/sftp-server

For this:

Subsystem sftp internal-sftp

We also have to add the following configuration to the end of the file:

Match user usersftp

ChrootDirectory %h

X11Forwarding no

AllowTcpForwarding no

ForceCommand internal-sftp

KbdInteractiveAuthentication yes

We restart the ssh service

service sshd restart

All the best.

:wq!