We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options:
- Open SFTP on our main server with restrictions (directory, user, size, etc).
- Create a micro server that will only respond to SFTP and upload the files to an S3 that our main server can read from.
Option 1 is faster and easier to maintain. Question is, how can I make sure it's safe?
The security measurements I want to take are the following:
- Run the SFTP with a restricted user.
- Limit SFTP to a single folder.
- The folder from 2 will be on a secondary volume and not our main volume, just to make sure it doesn't get full.
I found these instructions: https://passingcuriosity.com/2014/openssh-restrict-to-sftp-chroot/ which seem to cover pretty much what I plan. Only difference is the dir I'm locking the user inside would be on a different volume.
Now here's the question: do you think the plan above is safe enough? Are there any security hazards I'm missing here or maybe you think opening an SFTP on the main server is completely insane and should be avoided at all cost?