How To Create Sftp Only User In Ubuntu Debian Tecadmin

This blog post describes you create SFTP-only users without shell access on Ubuntu and Debian systems.

Step 1- Creating a New User

First of all, create a user account in your system to use as an SFTP user. The following command will create a new account named sftpuser with no shell access. You can change the username of your choice The command will prompt for the password to be set for a new account.

Step 2 – Create Directory for SFTP

Now, create the directory structure to be accessible by the SFTP user. Here we will allow users to access the “files” directory only. Now, change the ownership of the files directory to the sftpuser. So that SFTP users can read and write on this directory only. No files outside of this directory will be accessible. And set the owner and group owner of the /var/sftp to root. The root user has read/write access on this access. Group members and other accounts have only read and execute permissions. It will restrict SFTP users from writing files under /var/sftp directory.

Step 3 – Configure sshd for SFTP Only

/etc/ssh/sshd_config is the main configuration file of the OpenSSH server. Be careful with changing this configuration file, because any mistake can lead to connection loss. Edit the SSH configuration file in a text editor: then add the following settings at end of the file. Save the file and close. The directives are:

Match User Defines the username, on which the SFTP only configurations applied. In our case it is: sftpuser ForceCommand internal-sftp enforce the SFTP only access to user and restrict for the shell access. PasswordAuthentication yes allows password authentication for the user. ChrootDirectory /var/sftp Restrict user to access directories under this directory only. Here /var/sftp is act as the root directory of the user. AllowAgentForwarding no Specifies whether ssh-agent forwarding is permitted. The default is yes. AllowTcpForwarding no Specifies whether TCP forwarding is permitted. The default is yes. X11Forwarding no Specified where the graphical application is permitted for not

Restart SSH service to apply new settings: That’s it. You have successfully completed the instructions to create an SFTP-only user on Debian-based systems.

Step 4 – Security Tips (Options)

Here are some basic but important security tips for SFTP accounts in a production environment.

Conclusion

This tutorial describes you create SFTP-only users in the Ubuntu system. It will disabled shell access for the same users to restrict to a specified directory only.