0

I need to setup an scp server. Suppliers will upload files to that server via scp (not sftp). While configuration was easy for sftp, I really struggle with scp. There are some instructions and how-tos for other operating systems on the web. I tried to follow those, but I always receive an error message:

scp phpinfo.php abc@dev.sftpserver.example.org:/subdir/
/home/abc/bin/bash: Permission denied
lost connection

... no further hints in the logs:

Oct  3 23:16:13 ip-10-2-4-121 sshd[30945]: Accepted password for abc from 1.2.3.4 port 57248 ssh2
Oct  3 23:16:13 ip-10-2-4-121 sshd[30945]: pam_unix(sshd:session): session opened for user abc by (uid=0)
Oct  3 23:16:13 ip-10-2-4-121 sshd[30945]: Received disconnect from 1.2.3.4 port 57248:11: disconnected by user [postauth]
Oct  3 23:16:13 ip-10-2-4-121 sshd[30945]: Disconnected from 1.2.3.4 port 57248 [postauth]
Oct  3 23:16:13 ip-10-2-4-121 sshd[30945]: pam_unix(sshd:session): session closed for user abc

My /etc/ssh/sshd_config has been modified like this:

#Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp    

Match Group sftp
  ChrootDirectory %h
#  ForceCommand internal-sftp
  AllowTcpForwarding no

... I assume that the ForceCommand is not necessary, if I want to allow scp access.

Permissions in the /home directory:

[root@ip-10-2-4-121 abc]# ls -al /home
total 16
drwxr-xr-x  4 root     root     4096 Oct  3 21:42 .
dr-xr-xr-x 25 root     root     4096 Oct  3 20:08 ..
drwx------  9 root     root     4096 Oct  3 23:12 abc
drwx------  4 ec2-user ec2-user 4096 Oct  3 21:43 ec2-user

I have also tried to copy some dependencies, but I did not know how to find out which files have to be copied. https://www.wilderssecurity.com/threads/how-to-copy-only-needed-libraries-to-a-chroot.329486/ gave me a hint, which I have tried out:

cp --parents `ldd /bin/bash | cut -d " " -f 3` /home/abc
cp --parents `ldd /usr/bin/scp | cut -d " " -f 3` /home/abc
cp --parents `ldd /usr/libexec/openssh/sftp-server | cut -d " " -f 3` /home/abc

My directory structure under /home/abc:

.
├── bin
│   └── bash
├── dev
│   ├── null
│   ├── random
│   ├── tty
│   └── zero
├── etc
│   ├── group
│   ├── ld.so.cache
│   ├── ld.so.conf
│   ├── ld.so.conf.d
│   │   └── kernel-4.9.51-10.52.amzn1.x86_64.conf
│   └── passwd
├── lib
├── lib64
│   ├── ld-linux-x86-64.so.2
│   ├── libcrypto.so.10
│   ├── libcrypt.so.1
│   ├── libc.so.6
│   ├── libdl.so.2
│   ├── libfreebl3.so
│   ├── liblber-2.4.so.2
│   ├── libldap-2.4.so.2
│   ├── libnspr4.so
│   ├── libnss3.so
│   ├── libnssutil3.so
│   ├── libplc4.so
│   ├── libplds4.so
│   ├── libpthread.so.0
│   ├── libresolv.so.2
│   ├── librt.so.1
│   ├── libsasl2.so.2
│   ├── libsmime3.so
│   ├── libssl3.so
│   ├── libtic.so.5
│   ├── libtinfo.so.5
│   ├── libutil.so.1
│   └── libz.so.1
├── subdir
└── usr
    ├── bin
    │   └── scp
    ├── lib
    ├── lib64
    │   ├── libnss3.so
    │   ├── libnssutil3.so
    │   ├── libsasl2.so.2
    │   ├── libsmime3.so
    │   └── libssl3.so
    └── libexec
        └── openssh
            └── sftp-server

I further have modified /etc/passwd:

...
abc:x:501:501::/home/abc:/home/abc/bin/bash

Any help is greatly appreciated.

1

I had missed some further dependencies and permissions. This is, how to create a chrooted, ssh and scp enabled user from a blank amazon linux ec2 instance:

#!/bin/bash

#
# This script creates a chrooted user, scp enabled, on an Amazon Linux aws instance
#
# 2017-10-05
#

# change username and password here:
username="abc"
password="123456"

# create groups
groupadd sftp

# create chrooted user
useradd -m $username -G sftp
echo $username:$password | chpasswd

# enable password authentication in sshd
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.before_chroot
cat /etc/ssh/sshd_config | sed -e "s/PasswordAuthentication no/PasswordAuthentication yes/" > /etc/ssh/temp_sshd_config
mv -f /etc/ssh/temp_sshd_config /etc/ssh/sshd_config

# disable default sftp subsystem configuration in sshd
sed -e '/Subsystem sftp/ s/^#*/#/' -i /etc/ssh/sshd_config

# add sftp subsystem configuration to sshd
echo "Subsystem sftp internal-sftp" >> /etc/ssh/sshd_config
echo "Match Group sftp" >> /etc/ssh/sshd_config
echo "    ChrootDirectory %h" >> /etc/ssh/sshd_config
echo "    AllowTcpForwarding no" >> /etc/ssh/sshd_config

# restart ssh service
/etc/init.d/sshd restart

# create the chrooted directory structure
mkdir /home/$username/bin
mkdir /home/$username/dir
mkdir /home/$username/usr
mkdir /home/$username/usr/bin
mkdir /home/$username/usr/libexec
mkdir /home/$username/usr/libexec/openssh
mkdir /home/$username/lib/
mkdir /home/$username/etc
mkdir /home/$username/dev
mkdir /home/$username/dev/pts

# copy all dependencies
cp --parents `ldd /bin/bash | cut -d " " -f 3` /home/$username
cp --parents `ldd /usr/bin/scp | cut -d " " -f 3` /home/$username
cp --parents `ldd /usr/libexec/openssh/sftp-server | cut -d " " -f 3` /home/$username
cp --parents `ldd /bin/ls | cut -d " " -f 3` /home/$username/
cp /usr/lib64/libnss3.so /home/$username/lib64/
cp /usr/lib64/libtic.so.5 /home/$username/lib64/
cp /lib64/ld-linux-x86-64.so.2 /home/$username/lib64/
cp /usr/lib64/libssl3.so /home/$username/lib64/
cp /bin/bash /home/$username/bin/
cp /usr/bin/scp /home/$username/usr/bin/scp
cp /usr/libexec/openssh/sftp-server /home/$username/usr/libexec/openssh/
cp /bin/ls /home/$username/bin/
cp /lib64/libnss* /home/$username/lib64/
cp /usr/lib64/libnss* /home/$username/usr/lib64/
cp --parents `find . -type f -exec ldd '{}' \; | awk '{print $3}' | sort | uniq | grep -v '('` /home/$username/
cp -vf /etc/{passwd,group} /home/$username/etc/
cp -r /etc/ld.so* /home/$username/etc/

# create non-files
mknod -m 666 /home/$username/dev/null c 1 3
mknod -m 666 /home/$username/dev/tty c 5 0
mknod -m 666 /home/$username/dev/zero c 1 5
mknod -m 666 /home/$username/dev/random c 1 8
mount --bind /dev/pts /home/$username/dev/pts

# get the directory permissions right
chown $username.$username /home/$username/. -R
chmod 0755 /home/$username/bin
chmod 0666 /home/$username/.bashrc
chown root.root /home/$username
chmod 0755 /home/$username

https://gist.github.com/kmddevdani/b7687a74dacb250eda7b8e2f65f1c906

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.