4

I try to configure SFTP on Centos 7, on my first server it works perfectly, but on my second server when I try to connect me with :

sftp USERNAME@serveripaddress

I have this error :

Could not read packet: Connection reset by peer

I use this method :

adduser USERNAME
passwd USERNAME
groupadd sftp_only
usermod -aG sftp_only USERNAME

Configure SSH chroot :

vi /etc/ssh/sshd_config

Add a comment :

#Subsystem Sftp /usr/libexec/openssh/sftp-server

Add the line after :

Subsystem sftp internal-sftp

Add at the end of the file :

Group sftp_only Match
ChrootDirectory /var/www
ForceCommand internal-sftp
X11Forwarding No
AllowTcpForwarding No

Restart SSH :

service sshd restart

I have the same iptables rules on my 2 servers and I try with iptables disabled.

Maybe I need to install an FTP server like VSFTPD ?

Thank you to help me because I'm completely blocked since several hours.

2

You could use proftpd which offers a SFTP frontend. This way you can unite SFTP, FTP and FTP/S in one daemon. However you cannot use port 22 for SFTP or you'll have to give up on SSH on that port since proftpd and sshd cannot bind the same ports for SFTP.

  • 1
    To hunt down on your error start the ssh daemon with debug options and see what it outputs (put LogLevel DEBUG into sshd_config, restart sshd an watch /var/log/secure while connecting with your client) – fen Mar 2 '15 at 17:06
  • Thank you for your help, I have try to connect me with SFTP in debug mode, I have check the logs in /var/log/secure and finaly it's simple chown problem. – Olaf Mar 2 '15 at 18:12
  • 2
    Um wrong! You can absolutely use SFTP over SSH port 22. It actually works over a SSH tunnel and makes a subsystem call for SFTP. – user281460 Apr 13 '15 at 20:31
  • Does this really work in conjunction with proftpd? – fen Apr 14 '15 at 22:59
6

cat /var/log/auth.log

May 10 17:08:32 machine sshd[31902]: fatal: bad ownership or modes for chroot directory component "/var/www/html/nextcloud/"

that was my problem

After we can follow this one bad ownership or modes for chroot directory component

BTW I end up using bind solution Need help - limit access to sftp user to other users home->subfolder

0

I've got the same message from a client (Linux) who was trying to connect to our sftp (Windows/ad hoc soft). The client IP was in our SFTP's black list(for some reason the client reached the max failures allowed). Remove the IP from the black list and we were happy.

0

Make sure that home folder is owned by root and default folder is own by sftp user. For example, when you want to make incoming as home directory for user 'guestuser', you should create folder with user /guestuser/incoming. The guestuser folder should be owned by root and incoming should be owned by guestuser.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.