I've set up a new account to SFTP only by giving shell of /bin/false, and made member of stfp_only group. I then edited my /etc/ssh/sshd_config as outlined in numerous guides I've been reading like so

Subsystem sftp internal-sftp

Match Group sftp_only
ChrootDirectory /srv/uploads/%u
AllowTcpForwarding no
ForceCommand internal-sftp
X11Forwarding no

So far so good. I can upload files and everything is locked down for the most part, except the user can still mkdir, rmdir, and change file permissions which I do not want to allow for security reasons. I've been trying to get blacklist working like

ForceCommand internal-sftp -P mkdir,rmdir

However it appears that while those whitelist/blacklist parameters are available on OpenBSD, the version of sftp-server on Centos only allows for logging and file mask options

usage: sftp-server [-he] [-l log_level] [-f log_facility] [-u umask]
      [-m force_file_perms]  

Short of trying to compile the BSD version's source code, is there any other way? Something with ACL restrictions to allow files only, no folders, symlinks etc? Ban changing file permissions?

If there was a way to have the users uploaded files be created as root:sftp_only 664 then at least they could modify/delete their own files via group write but not change permissions to since they don't own them.

Using: CentOS release 6.10, OpenSSH_5.3p1


CentOS 6 ships with too old a version of OpenSSH. You can try installing your own version but you will then have to maintain that, I'd much prefer to rely on Red Hat/CentOS to keep that patched.

If you upgrade to CentOS 7, the version of OpenSSH shipped is 7.4p1 which supports the -P flag you require.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.