{"id":39,"date":"2012-09-11T05:13:14","date_gmt":"2012-09-11T05:13:14","guid":{"rendered":"https:\/\/www.nicktailor.com\/?p=39"},"modified":"2022-10-21T11:59:55","modified_gmt":"2022-10-21T11:59:55","slug":"jail-secondary-ftpwebuser-accounts-with-plesk-via-sftp","status":"publish","type":"post","link":"https:\/\/nicktailor.com\/tech-blog\/jail-secondary-ftpwebuser-accounts-with-plesk-via-sftp\/","title":{"rendered":"Jail Secondary FTP\/Webuser Accounts with Plesk via SFTP"},"content":{"rendered":"

How to Jail Secondary FTP\/Webuser Accounts with Plesk via SFTP<\/strong><\/p>\n

1.Log into Plesk and Create Secondary (“WebUser” inside plesk)user\/password (You need to do this so the client can update the password for the user from the GUI)<\/p>\n

2.Mkdir \/home\/newuseryoucreatedinplesk (since you created the user in plesk, the user homedirectory will need to manually created for jailing purposes)
\neg. Mkdir \/home\/superman<\/p>\n

3.? Next you want to do the following:
\n-# usermod -G sftp superman<\/em> (add the user)
\n-# usermod -s \/bin\/false superman<\/em> (change the bash of the user)
\n-# chmod -R root:root \/home\/superman<\/em>\u00a0(parent directory has to be owned by root for chroot)<\/strong>
\n-# chmod 755 \/home\/superman<\/em> (Permissions on parent directory has to be 755 for sftp to work via chroot)<\/strong><\/p>\n

4. Edit \/etc\/passwd file and change the directory path of superman<\/strong> to \/home\/superman<\/em> (You need to do this since plesk created the user, do not change the UID as this may be saved somewhere in plesk)<\/p>\n

eg. superman:x:10034:2522::\/home\/superman:\/bin\/false<\/em><\/p>\n

5. Now you are going to mount the directory that you wanted the user jailed into to the new users home directory<\/p>\n

#- Mount –bind <fullpathofdirectoryyouwanttojailuser> <pathtonewusershomdirectory>
\nEg.
\nMount –bind \/www_data\/test.com\/httpdocs\/jailed \/home\/superman\/jailed<\/p>\n

Note:so I create this file give it +x permissions and add it to \/etc\/rc.local so that if the server reboots you don’t loose your mounts.<\/strong>
\n6. Add the above line to \/etc\/init.d\/sftpjailedmounts.sh <–this is so if you reboot the server the mounts arent lost, this file is loaded by \/etc\/rc.local<\/p>\n

7. Now your going to change the permissions inside their home directory so the sftp user will be able to ftp files
\n#- chown superman:sftp \/home\/superman\/jailed<\/em><\/p>\n

8. Test and Ensure you can update the password from plesk admin panel for the client<\/p>\n

If you want to see your mount simply type mount and you will them.
\neg.<\/p>\n

[root@test]# mount
\n\/dev\/mapper\/VGroot-LVroot on \/ type ext3 (rw)
\nproc on \/proc type proc (rw)
\nsysfs on \/sys type sysfs (rw)
\ndevpts on \/dev\/pts type devpts (rw,gid=5,mode=620)
\n\/dev\/sda1 on \/boot type ext3 (rw)
\ntmpfs on \/dev\/shm type tmpfs (rw)
\n\/dev\/mapper\/VGroot-LVlocal on \/local type ext3 (rw)
\nnone on \/proc\/sys\/fs\/binfmt_misc type binfmt_misc (rw)
\nsunrpc on \/var\/lib\/nfs\/rpc_pipefs type rpc_pipefs (rw)
\nWEBI_NASdevl:\/vol\/WEBI_VerfConfig\/www_config on \/www_config type nfs (rw,addr=10.90.20.8)
\nWEBI_NASdevl:\/vol\/WEBI_VerfData\/www_data on \/www_data type nfs (rw,addr=10.90.20.8)
\ntmpfs on \/usr\/local\/psa\/handlers\/before-local type tmpfs (rw)
\ntmpfs on \/usr\/local\/psa\/handlers\/before-queue type tmpfs (rw)
\ntmpfs on \/usr\/local\/psa\/handlers\/before-remote type tmpfs (rw)
\ntmpfs on \/usr\/local\/psa\/handlers\/info type tmpfs (rw)
\ntmpfs on \/usr\/local\/psa\/handlers\/spool type tmpfs (rw,mode=0770,uid=2021,gid=31)
\n\/www_data\/test.com\/httpdocs\/jailed on \/home\/superman\/jailed type none<\/strong><\/em> (rw,bind)<\/strong><——<\/strong><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

How to Jail Secondary FTP\/Webuser Accounts with Plesk via SFTP 1.Log into Plesk and Create Secondary (“WebUser” inside plesk)user\/password (You need to do this so the client can update the password for the user from the GUI) 2.Mkdir \/home\/newuseryoucreatedinplesk (since you created the user in plesk, the user homedirectory will need to manually created for jailing purposes) eg. Mkdir \/home\/supermanRead More …<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58,138],"tags":[],"class_list":["post-39","post","type-post","status-publish","format-standard","hentry","category-centos","category-linux"],"_links":{"self":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/39","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=39"}],"version-history":[{"count":2,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/39\/revisions"}],"predecessor-version":[{"id":41,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/39\/revisions\/41"}],"wp:attachment":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=39"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=39"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=39"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}