I have been trying to configure my CentOS 6.5 minimal 64 bit machine to allow SFTP users to connect and get jailed to specific folders. I can sftp in using the unix commmand: "sftp user@localhost" and move around within the restricted directory, but I can't use LS or any other commands like that. However, the real issue is that I can't connect at all using FileZilla. I simply get this error:
Status: Retrieving directory listing... Command: pwd Response: Current directory is: "/" Command: ls Status: Listing directory / Error: Unable to open .: permission denied Error: Connection timed out after 20 seconds of inactivity
I'd love to be able to use LS when using the SFTP command in Unix but most importantly I need it to work with FileZilla.
Here is a description of the current setup:
Subsystem sftp internal-sftp Match Group sftp_users X11Forwarding no AllowTcpForwarding no ChrootDirectory /var/sftp/%u ForceCommand internal-sftp
grep user /etc/passwd
user : user sftp_users
ll / | grep var
drwxr-xr-x root root var
ll /var | grep sftp
drwxr-xr-x root root sftp
ll /var/sftp | grep user
drwxr-xr-x root root user
drwxrwxr-x user sftp_users incoming drwxrwxr-x user sftp_users outgoing
Everything I've read says that's how it's supposed to be setup, so please let me know what I'm missing. I just can't seem to get it to work properly.
Thanks for your time.
I used this command to modify my user's home directory;
usermod -d /incoming
that way he would land in /incoming rather than the full path of the directory as it was previously.
grep user /etc/passwd
ls -lrtd /var/sftp/user/incoming
drwxrwxr-x user sftp_users /var/sftp/user/incoming
#Subsystem sftp /usr/libexec/openssh/sftp-server Subsystem sftp internal-sftp -f AUTH -l INFO Match Group sftp_users ChrootDirectory /var/sftp/%u ForceCommand internal-sftp
However, I still get the same errors from using the SFTP command in UNIX and FileZilla on Windows.
I added the debug level logging to the sshd config, but the messages aren't populating in the /var/log/messages file for anyone but the root user. So that route is not working currently. Also the /var/log/secure file doesn't show any errors with the SFTP authentication and session start.
[root@...]# sftp user@localhost Connecting to localhost... user@localhost's password: sftp> ls Couldn't get handle: Permission denied sftp> cd .. sftp> cd incoming Couldn't canonicalise: Permission denied sftp> quit [root@...]#