SFTP Only Chroot Jail (OpenSSH v5)

This tutorial takes some time to write, edit, and update. If it has benefited you, please either take the time to email me or make a small donation. I am working on writing more Linux related tutorials.


Thank you!

This tutorial is a follow-up to the version 5 update of OpenSSH. In version 5, jailing is now natively supported.

NOTE: This tutorial is for attempting to jail users to their home directory and allowing them ONLY sftp access.

NOTE: This works and has been tested on centos 4.4 and 5.0

What does this do again...?

This will majorly increase security for a multi-user server. The main things it does are:

Lock users to their home directory
--This blocks their eyes from the rest of your system and from files like: system binaries, other users' files, backups, configuration files

Disable regular ssh access
--Many users just having a web site won't need an actual command interface. Its just one more thing to be hacked.

FTP already does this!!! right?
Yes, but your forgetting one thing... this is SFTP!!! It's encrypted and so it is much harder for hackers to sniff packets. Also, the user management is at the system level, so your server tells users what they can and can't do. If your FTPd runs as root or with a high permissions level and a ftp user hacks it, it means they have root or at least high permissions over the ENTIRE server? Not anymore.


Package names updated as of 10/15/2009 (Oct 15)


The Tutorial

This tutorial uses the /opt directory to install the necessary dependences. If you wish to install them anywhere else or do not have an opt directory on your server you may do so, but make sure to change all the paths in the code below. All commands must be run as root

NOTE: The jailing setup for OpenSSH ver5 is much cleaner and uses less hacks then ver4. If you need to jail users, make sure to update to version 5.
If you are looking for the tutorial for version 4, click here.

Another NOTE: This setup is meant for installing on a fresh server. If you already have configuration files for the programs we will be installing (zlib,openssl, and openssh), they will not be overwritten, but you will have to copy them from their old paths to the paths you install with here (recommended: /opt/...).

  1. You need the GNU Compiler Collection to install these programs. When it asks you if you want to proceed reply with a "y".
  2. Install zlib
  3. Now we install openssl into the opt directory as well The make commands here take forever to run. If the 'make test' command returns any errors, you will need to fix them before continuing.
  4. Next we will download openssh
  5. Now we will install openssh. To find where your xauth file is located you may need to run the "which xauth" command. If you know what you are doing you may add your own options to the configure command below. Some of these commands make take some time to run. Go grab a coke.
    REMEMBER: This tutorial is meant for setting up a server for the first time. You may need to copy your sshd_config file (or at least the directives you want to keep) from /etc/ssh to save your old settings.
  6. To automatically run the new ssh shell, we will use init. You need to change the following lines in /etc/init.d/sshd Then we will restart ssh and test to see if it is running smoothly. The telnet command should return some lines looking like this: You need to be sure that the last line includes the "OpenSSH_5.3" to confirm that it is the version we just installed.
  7. Next you need to edit '/opt/openssh/etc/sshd_config' to enable the jail.
    Replace any lines starting with 'subsystem' with this line: Also add (at the bottom of the file) the following lines Now, all users added to the 'sftponly' group will be jailed to their home directory.
  8. We will need to create the 'sftponly' group so we can add our untrustworthly users to it. Also, we set up the environment to allow jailing. Now when you create users that need to be jailed, make sure they belong to the 'sftponly' group. For the user "mark" with the password "test", you will need to do the folling steps. To set up the jail run the following commands When asked, enter 'test' as the password for mark.
  9. Try to log in as mark through putty (or any ssh terminal). You should get some sort of error involving an abort or denied access.
    Then try to log in as mark through winscp (or similar SFTP software).
  10. Congrats! you now have a jailed user.

NOTICE: Yum will not update these programs anymore (zlib,openssl,openssh). When a new version comes out, you will have to make your own install from a tarball again. Just follow the same directions.


Package names updated as of 10/15/2009 (Oct 15)


This tutorial takes some time to write, edit, and update. If it has benefited you, please either take the time to email me or make a small donation. I am working on writing more Linux related tutorials.


Thank you!


Credits