2

I changed sshd_config to jail users within specific group into their home directory. changed subsystem to sftp internal-sftp and used forcecommand: internal-sftp

However, this prevented the admin user on ubuntu from accessing sftp at all.

How to allow user let's call him 'admin' unrestricted access and not affect ssh privilege? admin uses key authentication.

I searched for documentation on forcecommand and subsystem but couldn't find much.

Currently I have this 

#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp intenal-sftp

Match Group somegroup
    PasswordAuthentication yes
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp
Improve this question
2
  • What does "from accessing sftp at all" mean? What errors you get on client and on server side? What groups is admin in?
    – Jakuje
    Apr 15, 2016 at 7:38
  • I wanted to try winscp but that closes window without saying anything or logging in. on filezilla it says: "Received unexpected end-of-file from SFTP server". on the server side auth.log shows that session opened for user 30 by (uid=0) then removed session NN new session 31 of user XX pam_unix (sshd:session) session closed for user XX
    – Dreaded semicolon
    Apr 15, 2016 at 9:20

2 Answers 2

Reset to default
2

You have got typo in the sshd_config:

Subsystem sftp intenal-sftp

should be 

Subsystem sftp internal-sftp
Improve this answer
1
  • Thanks! that did it. I had a dejavu moment. as I've seen same answer to different issue. probably I copied the code from the same place. but didn't think I had the same problem.
    – Dreaded semicolon
    Apr 15, 2016 at 12:41
0

this should handle it for you

    Match Group somegroup,!admin
     PasswordAuthentication yes
     ChrootDirectory %h
     X11Forwarding no
     AllowTcpForwarding no
     ForceCommand internal-sftp
Improve this answer
2
  • but admin user is not part of somegroup already. but not sure why using subsystem internal-sftp disables sftp access to admin
    – Dreaded semicolon
    Apr 15, 2016 at 6:45
  • Match Group *, !admin
    – Brett Moore
    Apr 15, 2016 at 16:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .