{"id":42,"date":"2012-09-11T05:24:33","date_gmt":"2012-09-11T05:24:33","guid":{"rendered":"https:\/\/www.nicktailor.com\/?p=42"},"modified":"2022-10-21T11:59:55","modified_gmt":"2022-10-21T11:59:55","slug":"how-to-jail-users-via-sftp-on-drupal-servers-using-aegir","status":"publish","type":"post","link":"https:\/\/nicktailor.com\/tech-blog\/how-to-jail-users-via-sftp-on-drupal-servers-using-aegir\/","title":{"rendered":"How to jail users via sftp on Drupal Servers using Aegir"},"content":{"rendered":"\n\n\n
\n
\n
\n
How to jail users via sftp on Drupal Servers<\/strong><\/span><\/div>\n<\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

You will need to ensure your openssh server your running is at least 5.1 If it not then please check out “How to jail subdomain sftp users via chroot with plesk” in my blog, it will have instructions on how to update your openssh if your running redhat or any similar OS.<\/strong><\/em><\/p>\n

Note: \/etc\/ssh\/sshd_config (this config is a slightly different on Drupal servers than plesk ones so that\u00a0Dreamweaver\u00a0<\/strong>could sftp)<\/em><\/div>\n
===================================<\/em><\/div>\n
<\/em># override default of no subsystems
\n#Subsystem sftp \/usr\/libexec\/openssh\/sftp-server\u00a0<\/strong><\/em><\/p>\n
<\/div>\n
Subsystem sftp internal-sftp
\nMatch Group sftp
\nChrootDirectory %h
\nForceCommand internal-sftp
\nAllowTcpForwarding no
\n====================================<\/div>\n<\/div>\n
<\/div>\n
1. Do the following:<\/span><\/div>\n
-# usermod -G sftp joe<\/em> (add the user)<\/strong>
\n-# usermod -s \/bin\/false joe<\/em> (change the bash of the user)<\/strong><\/div>\n
-# chmod -R root:root \/home\/joe<\/em> (parent directory has to be owned by root for chroot)<\/strong><\/div>\n
-# chmod 755 \/home\/joe<\/em> (Permissions on parent directory has to be 755 for sftp to work via chroot)<\/strong><\/div>\n
-# passwd joe<\/em> (set password for user)<\/strong><\/div>\n
2. Create a directory inside the home directory of the new user and name it the same of of the directory you want them to be jailed to<\/div>\n
<\/div>\n
mkdir \/home\/joe\/<\/em>(same name of directory you want user to be jailed to)<\/strong><\/div>\n
eg\u00a0mkdir \/home\/joe\/jailed<\/em><\/div>\n
3. Now you are going to mount the directory that you wanted the user jailed into to the new users home directory<\/div>\n
<\/div>\n
#- Mount –bind <fullpathofdirectoryyouwanttojailuser> <pathtonewusershomdirectory><\/em><\/div>\n
Eg.<\/div>\n
Mount –bind \/www_data\/sites\/drupal-6.19\/sites\/test.com\/jailed \/home\/joe\/jailed<\/em><\/div>\n
Note: I create this file and add it to \/etc\/rc.local so that if your server reboots, you wont loose your mounts\u00a0<\/strong><\/em><\/div>\n
4. Add the above line to \/etc\/init.d\/sftpjailedmounts.sh <–this is so if you reboot the server the mounts arent lost, this file is loaded by \/etc\/rc.local<\/div>\n
<\/div>\n
5. Now your going to change the permissions inside their home directory so the sftp user will be able to ftp files<\/p>\n
#- chown test2:aegir \/home\/joe\/jailed<\/em><\/div>\n
<\/div>\n
If you want to see your mount simply type mount and you will them.<\/div>\n
eg.<\/div>\n
[root@dpadmprod11 jhall]# mount
\n\/dev\/mapper\/VGroot-LVroot on \/ type ext3 (rw)
\nproc on \/proc type proc (rw)
\nsysfs on \/sys type sysfs (rw)
\ndevpts on \/dev\/pts type devpts (rw,gid=5,mode=620)
\n\/dev\/sda1 on \/boot type ext3 (rw)
\ntmpfs on \/dev\/shm type tmpfs (rw)
\n\/dev\/mapper\/VGroot-LVlocal on \/local type ext3 (rw)
\nnone on \/proc\/sys\/fs\/binfmt_misc type binfmt_misc (rw)
\nsunrpc on \/var\/lib\/nfs\/rpc_pipefs type rpc_pipefs (rw)
\nWEBI_NASprod:\/vol\/WEBI_DpProdConfig\/www_config on \/www_config type nfs (rw,addr=10.90.20.6)
\nWEBI_NASprod:\/vol\/WEBI_DpProdData\/www_data on \/www_data type nfs (rw,addr=10.90.20.6)
\n\/www_data\/sites\/drupal-6.19\/sites\/test.com\/webcam on \/home\/webcam\/webcam type none (rw,bind)
\n\/www_data\/sites\/drupal-6.19\/sites\/test.com\/pharmdprivate on \/home\/pharmsci\/pharmdprivate type none (rw,bind)
\n\/www_data\/sites\/drupal-6.19\/sites\/pharmacy.ubc.ca\/jailed on \/home\/joe\/jailed type none (rw,bind)\u00a0<——<\/strong><\/em><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

How to jail users via sftp on Drupal Servers You will need to ensure your openssh server your running is at least 5.1 If it not then please check out “How to jail subdomain sftp users via chroot with plesk” in my blog, it will have instructions on how to update your openssh if your running redhat or any similarRead More …<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58,138],"tags":[],"class_list":["post-42","post","type-post","status-publish","format-standard","hentry","category-centos","category-linux"],"_links":{"self":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/42","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=42"}],"version-history":[{"count":6,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/42\/revisions"}],"predecessor-version":[{"id":1627,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/42\/revisions\/1627"}],"wp:attachment":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=42"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=42"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=42"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}