Introduction

sftp based file transfers should be made possible. So here a description how to do that. We create user, who is only allowed to upload or download files - no ssh. The user are bound to a special directory in a specific sftp location.

General Work

•Define a location for all sftp transfers

osudo mkdir -p /var/sftp/

osudo chown root:root /var/sftp

osudo chmod 755 /var/sftp

Create a new user

•Create a user for upload ("sudo adduser [username]")

•Define a location for te users sftp transfers

osudo mkdir -p /var/sftp/[username]

osudo chown root:root /var/sftp/[username]

osudo chmod 755 /var/sftp/[username] (what about 750 here ?)

Upload via Private Key

Due to the fact, that you created a new user, it has a home directory and you have a ".ssh" directory and you can put the public key there.

Upload Directory for this new user

The sftp needs a root only access landing platform - so the directory /var/sftp/[username] is ok for reading (download) files, but for uploads the directory is not good enough. So one has to create a special upload subdirectory to allow that:

osudo mkdir -p /var/sftp/[username]/upload

osudo chown root:[username] /var/sftp/[username]/upload

osudo chmod 750 /var/sftp/[username]/upload

Reference

Tell SSH about that

•Change the configuration of the SSHD service by editing /etc/ssh/sshd_config and add the following code at the end of that file:

Match User [username]

ForceCommand internal-sftp

PasswordAuthentication yes

ChrootDirectory = /var/sftp/[username]

PermitTunnel no

AllowAgentForwarding no

AllowTcpForwarding no

X11Forwarding no

•Restart the service via "sudo systemctl restart sshd"