I've read many articles and questions on SF about this, and still can't figure out if the way I'm doing it is (a) possible, and (b) secure.
The server is running on AWS EC2, and all access is via SSH keys. I also only open port 22 to my own IP, but it seems if I want to allow others to access via SFTP, I'll need to open port 22 to the world (or spend my days managing firewall rules for dynamic IP addresses). Is this really better than, say, vsftp on port 21?
Assuming for the moment SFTP on port 22 is best, this is what I've done:
- Created an 'ftp' user with a public / private key
- Set up
/home/ftp/.ssh/authorized_keysand tested SSH access
- Added a
- Adjusted the permissions from
/var/wwwdownwards so the chroot 'works'
Now, I'm stuck in a seeming catch 22, which is, I suspect (hope), just misconfiguration. Without the chroot block in sshd_config, I can connect either via Putty or an SFTP client, and all is well - apart from having access to the whole file system. With the chroot block in place, I was hitting the
Could not chdir to home directory /home/ftp error during authentication, as now the
/home/ftp/.ssh folder is unreachable and so the keys don't work. This old question / answer suggests putting a
.ssh folder inside the
/var/www/html/ folder, but that seems very odd to me - is that really OK to do, given that it's accessible by the web server?
Is there a more 'correct' way to have a user connect via SSH key and then be restricted to only /var/www/html?
%h, and then mounting the
/home/ftp/. Now I can connect with SFTP. But I do still also see the
/home/ftp, and of course I can't make that inaccessible, or the initial SSH connection fails. So for now I've made those files owned by root, and only
authorized_hostsis readable by others. Seems a locked down as possible.
ForceCommand internal-sftp. I think that obviates the need for rssh - or did I miss something?