SFTP

What is SFTP?

SFTP is the SSH File Transfer Protocol, an extension of Secure Shell (SSH) that provides secure file transfer capabilities. It should not be confused with FTP or FTPS. Unlike FTP, SFTP encrypts both commands and data, preventing passwords and sensitive information from being transmitted in plain text. It cannot interoperate with FTP software. FTPS extends the FTP standard so clients can request encrypted FTP sessions by sending the AUTH TLS command.

Setting Up a Simple Server

The goal is to set up an SFTP server where users are restricted to their home directory and have limited system privileges.

Setting Up the Server

Assuming SSH is already installed, edit the SSH server configuration file:

1. Open the config file:

   sudo nano /etc/ssh/sshd_config
   

2. Comment out the following line by adding a # at the beginning:

   #Subsystem sftp /usr/lib/openssh/sftp-server
   

3. Add the following at the end of the file:

   Subsystem sftp internal-sftp
   
   Match Group sftpusers
       ChrootDirectory %h
       ForceCommand internal-sftp
       X11Forwarding no
       AllowTCPForwarding no
       PasswordAuthentication yes
   

4. Restart SSH:

   sudo service ssh restart
   

Creating the sftpusers Group

sudo groupadd sftpusers

Creating SFTP Users

1. Create the user:

   sudo adduser username
   

2. Prevent SSH login and assign the user to the SFTP group:

   sudo usermod -G sftpusers username
   sudo usermod -s /usr/sbin/nologin username
   

3. Restrict the user to their home directory:

   sudo chown root:root /home/username
   sudo chmod 755 /home/username
   

4. Create a folder to which the user can upload files:

   sudo mkdir /home/username/share
   sudo chown username:sftpusers /home/username/share
   

Notes

Sources