SFTP Jail
=========

About
-----

These instructions describe how to set up a second sshd server, independent
from the already-installed sshd, without the need for installing additional
packages onto the system. The purposes for doing this may be numerous, but the
purpose described here (specifically in the second section) is to provide a
dedicated sftp server that jails all connecting users to their home directory.

The original instructions for running multiple ssh instances on Red Hat style
systems were provided by Dale Dellutri at the address:
http://fixunix.com/ssh/364505-running-multiple-sshd-instances-one-server.html

I have fleshed out the above instructions, modifying them for Debian and
specifically to provide a second ssh instance which serves an sftp jail.

Create a second, independent sshd
---------------------------------

The instructions below use 'sftpjail' because the next section of instructions
pertains to only allowing users to sftp to their home directories. However, you
can use a different name and configure the second ssh server to do whatever you
want (like having an admin login that is treated with a higher priority by the
firewall, or having a second sshd so that the primary sshd can be completely
stopped/reconfigured, etc). The purpose and difference between the original
sshd and your copy only lies in the options you use in their sshd_config files
and how you treat their traffic.

1. Copy the ssh_config to a new file. Modify the new file to fit your
requirements.  For sftpjail purposes, no modifications should be needed.

.. code-block:: none

  cp -p /etc/ssh/ssh_config /etc/ssh/sftpjail_config

2. Copy the sshd_config to a new file. Modify this also to fit your needs. In
particular, you should change one or more of ListenAddress and Port so that
this sshd does not conflict with your normal sshd.

It is recommended to use different HostKey files. The generation of these files
is explained in step 6. The paths for the sftpjail:
/etc/ssh/sftpjail_host_rsa_key and /etc/ssh/sftpjail_host_dsa_key.

::

    cp -p /etc/ssh/sshd_config /etc/ssh/sftpjaild_config

3. Create a symlink to sshd named sftpjaild

::

    cd /usr/sbin/
    ln -s sshd sftpjaild

4. Create a symlink to the pam.d ssh settings for the sftpjail.

::

    cd /etc/pam.d/
    ln -s sshd sftpjaild

5. Copy the service launching script. This file needs to be modified so that
pretty much everywhere sshd is referenced sftpjaild should be substituted.
This includes executables, config files, pid files and key files, for example.
On CentOS/RHEL this file is sshd, not ssh.

::

    cp -p /etc/init.d/ssh /etc/init.d/sftpjail

Also, on Debian add a -f option so that the sftpjaild_config file is used for
configuration: SSHD_OPTS="$SSHD_OPTS -f /etc/ssh/sftpjaild_config", as shown
below.

::

    # Look for this section:
    if [ -n "$2" ]; then
        SSHD_OPTS="$SSHD_OPTS $2"
    fi
    # Add this line:
    SSHD_OPTS="$SSHD_OPTS -f /etc/ssh/sftpjaild_config"

Also on Debian, change Required-Start to $all to prevent this ssh process from
binding and preventing your normal sshd from starting.

.. code-block:: none

    # Required-Start:       $all


6. Add the service to the init scripts and generate the new HostKey files.
Finally, start the service.

On Debian:

::

    update-rc.d sftpjail defaults
    ssh-keygen -b 2048 -t rsa -f /etc/ssh/sftpjail_host_rsa_key
    ssh-keygen -t dsa -f /etc/ssh/sftpjail_host_dsa_key
    /etc/init.d/sftpjaild start

On CentOS/RHEL:

::

    chkconfig --add sftpjaild
    service sftpjaild start # this will automatically create specified keys

Configure sftp only and jailing
-------------------------------

1. In sftpjaild_config, add the following to the end of the file. This jails
the user to their home directory, but you may change the directory mapping,
or jail them to a directory within their home, such as /home/%u/public_html.
In order for jailing to work, the ChrootDirectory must be owned by root.

::

    ChrootDirectory /home/%u
    ForceCommand internal-sftp
    AllowTcpForwarding no

2. The above will result in jailing every user that connects to this sshd
server. If you would rather control which users are jailed and which are not,
then instead add the additional Match directive as shown below and also follow
steps 3 and 4.

::

    Match Group sftponly
      ChrootDirectory /home/%u
      ForceCommand internal-sftp
      AllowTcpForwarding no

3. Create the sftpjail group.

::

    groupadd sftpjail

4. Add user(s) to sftpjail group. These users will be jailed. Users not in this
group will not be jailed, and sftp will work normally for them.

::

    usermod -a -G sftpjail [username]

Also, if your users are only going to be uploading files for the web, then
change their primary group to www-data (Debian) or apache (CentOS/RHEL).

::

    usermod -g www-data [username]

5. Optionally, you may wish to restrict sftp users login capabilities more. If
the user is not supposed to ever have console access, disable their login
shell.

::

    usermod -s /bin/false [username]

6. Also optionally, you may wish to further restritct those who can log into
the sftp server by adding more options to the sftpjaild_config. If you are
using the sftpjail group as described above, you may want only jailed users to
use this server (AllowGroups). Or, if you are not using an sftpjail group you
can still restrict the use of the sftp server on a per user basis (AllowUsers).

::

    AllowGroups sftpjail

or

::

    AllowUsers username

7. Restart ssh and celebrate by giving to charity or getting me something on my
wish list.

::

    /etc/init.d/sftpjail restart