2

I changed sshd_config to jail users within specific group into their home directory. changed subsystem to sftp internal-sftp and used forcecommand: internal-sftp

However, this prevented the admin user on ubuntu from accessing sftp at all.

How to allow user let's call him 'admin' unrestricted access and not affect ssh privilege? admin uses key authentication.

I searched for documentation on forcecommand and subsystem but couldn't find much.

Currently I have this

#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp intenal-sftp

Match Group somegroup
    PasswordAuthentication yes
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp
  • What does "from accessing sftp at all" mean? What errors you get on client and on server side? What groups is admin in? – Jakuje Apr 15 '16 at 7:38
  • I wanted to try winscp but that closes window without saying anything or logging in. on filezilla it says: "Received unexpected end-of-file from SFTP server". on the server side auth.log shows that session opened for user 30 by (uid=0) then removed session NN new session 31 of user XX pam_unix (sshd:session) session closed for user XX – Dreaded semicolon Apr 15 '16 at 9:20
2

You have got typo in the sshd_config:

Subsystem sftp intenal-sftp

should be

Subsystem sftp internal-sftp
  • Thanks! that did it. I had a dejavu moment. as I've seen same answer to different issue. probably I copied the code from the same place. but didn't think I had the same problem. – Dreaded semicolon Apr 15 '16 at 12:41
0

this should handle it for you

    Match Group somegroup,!admin
     PasswordAuthentication yes
     ChrootDirectory %h
     X11Forwarding no
     AllowTcpForwarding no
     ForceCommand internal-sftp
  • but admin user is not part of somegroup already. but not sure why using subsystem internal-sftp disables sftp access to admin – Dreaded semicolon Apr 15 '16 at 6:45
  • Match Group *, !admin – Brett Moore Apr 15 '16 at 16:23

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.