10

I'd like to use SFTP for all the sites on my cPanel CentOS server as we had an FTP password hacked before (not hard). However I don't want each sites SFTP account to have shell access (not even jailed shell). Is this possible and how? I'm quiet new to UNIX, server management and the command line.

4 Answers 4

12

I'm not sure which version of OpenSSH is bundled with CentOS, but if it is 4.9 or newer then you can actually do it with OpenSSH with no need to install any additional software.

I wrote a blog post about this recently, you can check it out here: http://blog.frands.net/sftp-only-chroot-users-with-openssh-in-debian-166/

The guide is for Debian, but it's pretty much the same if the version of OpenSSH is 4.9 or more. You find out the version by issuing this command:

ssh -V

Also, in my example I use a static directory for all users. You can use %u in the config file, which will be replaced by the username. So the ChrootDirectory could be set to /www/users/%u

2
  • +1 for no add'l software!
    – walkeran
    May 1, 2011 at 13:50
  • Excellent blog post Frands! I followed it to a T and everything just worked
    – sente
    Jun 20, 2012 at 11:38
6

Set scponly as login shell for those users.

5

RSSH - Restricted SSH will do what you are after.

RSSH is a shell wrapper that will only allow a user to access the SSH parts you permit, it's a bit tricky to set up at first with a chroot environment etc.

http://www.pizzashack.org/rssh/

2

You may want to consider MySecureShell which offers:

Control of bandwidth. Security rights informations. Administration of the server with a graphical interface. Management of activity of the server with logs. Restrictions of users by ip, groups.

I've used this in the past; it's straightforward to install and configure and is actively developed. For you, there are CentOS packages and a GUI to help with configuration and administration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .