What are the rules for SFTP users?

I have an FTP server that authenticates via an API and has user folders in:

/home/ftpusers/files/<username>

Some users have requested SFTP instead and since I already have processes in place to put files in the user's directory, I figure I can just create accounts for the users.

useradd -g sftpgroup -d /home/ftpusers/files/username/ -s /sbin/nologin username
mkdir -p /home/ftpusers/files/username/.ssh
chown -R username:ftpgroup /home/ftpusers/files/username
chmod -R 770 /home/ftpusers/files/username
echo "ssh-rsa user key" > /home/ftpusers/files/username/.ssh/authorized_keys
chown username:sftpgroup /home/ftpusers/files/username/.ssh
chmod 700 /home/ftpusers/files/username/.ssh
chown username:sftpgroup /home/ftpusers/files/username/.ssh/authorized_keys
chmod 600 /home/ftpusers/files/username/.ssh/authorized_keys

the ftpgroup is so a system account can place files in the user folder the sftpgroup is to lock this user to just SFTP using:

Match Group sftpgroup
ForceCommand internal-sftp
AllowTCPForwarding no
X11Forwarding no

Unfortunately this doesn't work. No useful error, just:

Permission denied (publickey)

It does work fine though if I create a user in a more standard way in the /home/ directory

Any ideas on why? I know chroot has a lot of permission restrictions. Is this something like that?

Added namei output: Sure thing:

namei -l /home/ftpusers/files/jmandel/.ssh
f: /home/ftpusers/files/jmandel/.ssh
dr-xr-xr-x root    root      /
drwxr-xr-x root    root      home
drwxrwx--- ftpuser ftpgroup  ftpusers
drwxrwx--- ftpuser ftpgroup  files
drwxrwx--- jmandel ftpgroup  jmandel
drwx------ jmandel sftpgroup .ssh

Marked answer below has good information in comment thread

Supergibbs

Posted 2018-08-25T15:06:19.887

Reputation: 153

Answers

Add to your sshd_config file following directive and restart ssh:

AuthorizedKeysFile /home/ftpusers/files/%u/.ssh/authorized_keys .ssh/authorized_keys

This will tell ssh daemon where to look for public keys.

Personally I don't use authorized_keys for a long time, but using instead
AuthorizedKeysCommand where I call my program that looking in sqlite database user's key and send them back for authentication. This way I prevent users/hackers to use their own keys and such configuration don't disclose place where public keys are located.

Alex

Posted 2018-08-25T15:06:19.887

Reputation: 5 606

This makes a lot of sense but it didn't seem to work – Supergibbs – 2018-08-26T04:14:02.687

@Supergibbs Could you add to your question output of: namei -l /home/ftpusers/files/SomeUserName/.ssh ? – Alex – 2018-08-26T04:34:50.920

Sure thing, added above for better formatting – Supergibbs – 2018-08-27T15:36:25.583

Check if user jmandel belonging to the group ftpgroup by running id jmandel – Alex – 2018-08-27T15:48:42.953

It's not because I don't want it to, that would allow jmandel access to other users folders. There is a user in the ftpgroup that places files in various user folders. As a test though, I added jmandel to ftpgroup and it didn't help – Supergibbs – 2018-08-27T18:54:57.923

If users aren't belong to ftpgroup and directory /home/ftpusers restricting access to group other then how they would travel to their ftp(home) ? Try to set 775 to directories /home/ftpusers and /home/ftpusers/files for the test purpose. – Alex – 2018-08-27T19:02:55.893

They are the owner of their home directory, do they also need access for the full path? Not a lot of linux admin experience here.

I tried 775 and it didn't work either – Supergibbs – 2018-08-28T20:11:00.800

Can you remove temporally public key authentication and try SFTP with plain password ? – Alex – 2018-08-28T20:40:27.933

So password worked! But folder permissions did not. Seems like users need permissions for the full path to their home dir. This might not work out the way I need it to. Thanks for all your help! Still not sure why keys aren't working either. – Supergibbs – 2018-09-04T16:23:24.810

Figured it out! home directories need to be 700 for key logins (along with .ssh dir and the authorized_keys file needs to be 600). Alternatively, add "StrictModes no" to sshd_config. Thanks for all the help Alex! – Supergibbs – 2018-09-04T22:58:54.303

Additionally, I used 771 to allow users access to their home folder but not be able to list /home/ directory. That would expose our client list – Supergibbs – 2018-09-05T16:04:44.587

Is it really

echo "ssh-rsa user key" > /home/ftpusers/files/username/.ssh/authorized_keys

authorized_keys contains the public key of the people allowed to log in as this userid, so it's different for each userid you create. In theory the users generate their own public/private key pair and give you the public key. You can of course generate the pair yourself and give them the private part, but if anything bad happens they can claim it was done by someone else using their private key.

xenoid

Posted 2018-08-25T15:06:19.887

Reputation: 7 552

The user provides me with their public key and I use it to create their account – Supergibbs – 2018-08-26T04:12:59.627