How to create SFTP user with specified directory permissions

2 min read 23-10-2024

the ifix

How to create SFTP user with specified directory permissions

Creating a Secure File Transfer Protocol (SFTP) user with specified directory permissions is essential for managing secure file transfers on a server. This process ensures that users only have access to the directories they need, enhancing security and organization.

Understanding the Problem

In this article, we'll explore how to create an SFTP user, configure their home directory, and set the appropriate permissions. This is particularly useful for system administrators managing multiple users on a server while maintaining tight security.

Example Scenario

Let's consider the following example where we want to create a new SFTP user called sftpuser, giving them access only to a directory /var/www/sftpuser_uploads.

Original Code

The following code snippet demonstrates the steps to create a new user and set up the necessary directory permissions:

# Create a new user for SFTP access
sudo adduser sftpuser

# Create the directory for SFTP uploads
sudo mkdir -p /var/www/sftpuser_uploads

# Set the ownership of the directory to the new user
sudo chown root:root /var/www/sftpuser_uploads

# Set the permissions for the directory
sudo chmod 755 /var/www/sftpuser_uploads

# Create a subdirectory where the user can write files
sudo mkdir /var/www/sftpuser_uploads/incoming
sudo chown sftpuser:sftpuser /var/www/sftpuser_uploads/incoming
sudo chmod 755 /var/www/sftpuser_uploads/incoming

# Configure SSH to set up SFTP only access
sudo nano /etc/ssh/sshd_config

Steps to Create an SFTP User

Here’s a step-by-step guide on how to accomplish this.

Create the SFTP User: Use the adduser command to create a new user account.
```
sudo adduser sftpuser
```
Create the Upload Directory: Make a new directory where the user will upload files.
```
sudo mkdir -p /var/www/sftpuser_uploads
```
Set Ownership: Change the ownership of the directory to root for security.
```
sudo chown root:root /var/www/sftpuser_uploads
```
Set Permissions: Establish directory permissions to ensure the user cannot access directories above their home directory.
```
sudo chmod 755 /var/www/sftpuser_uploads
```

Create a Subdirectory for File Uploads: Inside the main upload directory, create a subdirectory that the user can write to.

sudo mkdir /var/www/sftpuser_uploads/incoming
sudo chown sftpuser:sftpuser /var/www/sftpuser_uploads/incoming
sudo chmod 755 /var/www/sftpuser_uploads/incoming

Configure SSH for SFTP Access: Open the SSH configuration file to specify that the user should be limited to SFTP only.
```
sudo nano /etc/ssh/sshd_config
```
Add the following lines at the end of the file:
```
Match User sftpuser
   ChrootDirectory /var/www/sftpuser_uploads
   ForceCommand internal-sftp
   AllowTcpForwarding no
```
Restart SSH Service: For the changes to take effect, restart the SSH service.
```
sudo systemctl restart ssh
```

Conclusion

Now you've successfully created an SFTP user with limited directory permissions. This setup not only secures your server but also streamlines file management for your users.

Additional Information

Security: Always ensure that you use strong passwords and follow best practices to secure your server against unauthorized access.
Testing: After completing the setup, test the SFTP connection using a client like FileZilla or WinSCP to ensure that the user can only access their designated directory.

Useful Resources

SSH Manual
FileZilla for a user-friendly SFTP client.
WinSCP for Windows users.

By following this guide, you can create SFTP users tailored to your requirements, ensuring secure and efficient file transfers.