I have a linux host with openssh that permits users to login with public key.
But now I have some users who will need to access the host as a file drop using sftp. In addition, these users will user passwords rather than key pairs.
I make all of these users belong to the group
firstname.lastname@example.org:~$ id uid=1005(an_sftp_user) gid=1007(an_sftp_user) groups=1007(an_sftp_user),1006(sftp_users) email@example.com:~$ groups an_sftp_user sftp_users firstname.lastname@example.org:~$
Now I create the file
/etc/ssh/sshd_config.d/sftp_users.conf owned by root, 0644:
Match Group sftp_users X11Forwarding no AllowTcpForwarding no AuthorizedKeysCommand /bin/true AuthenticationMethods keyboard-interactive PasswordAuthentication yes ChrootDirectory /sftp-incoming
What I want this to do is to permit users in the group
sftp_users to be able to connect with password and access
What actually happens is that I see a message server side in
auth.log that says merely that the connection was closed and, client side, I see (using
sftp -v) that it tries the certificates it finds in
$HOME/.ssh (I've disabled my ssh-agent for these tests) but never tries password login.
Indeed, one line is this:
debug1: Authentications that can continue: publickey
So somehow my Match is not being satisfied or not being seen. But I'm unclear why.
Any suggestions where I've gone wrong?
The solution from @Gogowitsch largely answers this, especially the note that
sftp-internal is, well, internal to openssh and so doesn't need a binary to be available in my chroot jail. Also important was to discover that chroot requires that the chain of directories be 0755 root all the way down, so I had to sort some permissions.
His suggestion to put the config all in the one
sshd_config file was also helpful. Indeed, once it was working, moving that block back to a config file and using
Include to include it fails without error. The block simply isn't used. I'm using 8.2:
OpenSSH_8.2p1 Ubuntu-4ubuntu0.1, OpenSSL 1.1.1f 31 Mar 2020