5

I am trying to configure a SFTP server for some automated backups. I configured an Ubuntu 14.04 server and have had partial success. The idea I'm looking to do is this:

  1. A user will be created for each particular system to be backed up. SFTP only.
  2. The user will be Chrooted and not be able to read or write outside their home directory.
  3. The user's home will be the "root" once logged in.
  4. The user will be able to upload files to the root. (This is where I'm stuck.)

I used the following snippet to create the Chroot in sshd_config like this:

Match Group sftpbackup
   ChrootDirectory /srv/sftpbackup/%u
   X11Forwarding no
   AllowTcpForwarding no
   ForceCommand internal-sftp

Then I set the permissions on /srv/sftpbackup as per the requirements.

# ls -l
total 4
drwxr-x--- 3 root sftpbackup 4096 Jan  5 15:29 user1
#

Now, the user can login but cannot upload files (Permission Denied). If I change the directory ownership to look like this:

# ls -l
total 4
drwxrwx--- 3 user1 sftpbackup 4096 Jan  5 15:29 user1
#

Then the user cannot login, from auth.log:

sshd[14835]: fatal: bad ownership or modes for chroot directory "/srv/sftpbackup/user1"

It seems like, if the user's home directory is the SFTP chroot, root must own the directory, thus a subdirectory must be created so that the user can write to it.

Is there anyway to make the root writeable? Looking at various websites, it appears that there is no way to achieve what I want. I don't quite understand though what the difference is between having the chroot dir writeable by the user and having a subdirectory writeable. Insights would be appreciated.

Note: My goal is to create a server where backups can be stored by various devices. The devices will be configured by a third-party vendor, thus I'm trying to keep things as simple (one user name per device, all files go to the "root" once logged in) and secure (the users created will have minimal rights to the server) as possible. Apologies if my desires are a bit rigid.

imlepid
  • 175
  • 1
  • 3
  • 10

1 Answers1

4

Internal-sftp require chrooted user home to reside inside root-owned dir:

/some/path/root-owned/user-dir1
                     /user-dir2

Root-owned dir should have 555 permissions and user-dirs should be created by root and owned by specific user. Inside subdirs user can do anything, but he can't delete or rename user-dir[12].

This is internal-sftp restrictions.

Kondybas
  • 6,964
  • 2
  • 20
  • 24
  • This answer is incorrect! The actual chrooted user home should be root owned, not just the directory in which that user home resides! So in this example, both `user-dir1` and `user-dir2` must be root owned in order to be chroot targets. – Frans Mar 14 '22 at 18:25
  • @Frans I mean that `/some/path/root-owned/` should be home for chrooted user. While `user-dir1` and `user-dir2` are the dirs c/user have RW permissions inside. C/user can do anything inside that dirs but can't delete them and can't create another dirs or files in his home dir. – Kondybas Mar 14 '22 at 21:46
  • 2
    Yes, but that doesn't satisfy the OP's requirement 4 which is that the user should be able to write to the root of his chroot jail - I think the only answer is that this is not possible with OpenSSH. – Frans Mar 15 '22 at 10:28