I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access.
I have set up the access as follows:
- SFTP (SSH) access with username and password:
PasswordAuthentication yes
. - Users belong to the group
sftp
which is forced to useinternal-sftp
. - Login is sandboxed to
ChrootDirectory %h
which is/srv/sftp/incoming
. - Login Shell is
/bin/false
.
Is there anything else I can do to secure an SFTP access for a such a range of users?
The machine runs ArchLinux. Webserver is nginx
but the files in /srv/sftp/incoming
are not served by the webserver. It's just for internal use.