LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 12-05-2023, 12:06 PM   #1
Calab
Member
 
Registered: Oct 2003
Location: Calgary, AB, Canada
Distribution: CentOS, Ubuntu
Posts: 56

Rep: Reputation: 2
Question RHEL 7 FTP server


We have a system running RHEL 7. Users can connect using SFTP and their /home/user directory is where they start. They can browse the whole system with similar permissions as if they had made an SSH connection.

What we need to do is create an account that can only access an FTP directory and it's subdirectories. We don't want this user to be able to browse the rest of the system.

We also need our other users to be able to access their home directories using SFTP, as well as access the FTP directory and subdirectories.

What we currently have installed is: ftp-0.17-67.el7.x86_64

Is this possible? Can we do it with the FTP package currently installed or should we install something like ProFTP?
 
Old 12-05-2023, 12:17 PM   #2
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 26,747

Rep: Reputation: 7982Reputation: 7982Reputation: 7982Reputation: 7982Reputation: 7982Reputation: 7982Reputation: 7982Reputation: 7982Reputation: 7982Reputation: 7982Reputation: 7982
Quote:
Originally Posted by Calab View Post
We have a system running RHEL 7. Users can connect using SFTP and their /home/user directory is where they start. They can browse the whole system with similar permissions as if they had made an SSH connection.

What we need to do is create an account that can only access an FTP directory and it's subdirectories. We don't want this user to be able to browse the rest of the system. We also need our other users to be able to access their home directories using SFTP, as well as access the FTP directory and subdirectories.

What we currently have installed is: ftp-0.17-67.el7.x86_64 Is this possible? Can we do it with the FTP package currently installed or should we install something like ProFTP?
The package is for the FTP client; RHEL uses vsftp, and there is ample documentation regarding its configuration:
https://access.redhat.com/solutions/1346983

However, SFTP and FTP are two VERY different things; the term you're looking for is chroot, meaning that users can only access their own resources, and not traverse the filesystem any further. If you create one user that's chroot'ed to their own folder, and your local users are using SFTP (with the appropriate permissions), they should be able to traverse that structure if you don't chroot THEM.
 
1 members found this post helpful.
Old 12-05-2023, 12:26 PM   #3
Turbocapitalist
LQ Guru
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 7,347
Blog Entries: 3

Rep: Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766
Yes, you can set up a chrooted SFTP account while leaving the others SFTP accounts untouched, all without compromising the integrity and safety of the system by adding vsftp.

The one thing to know with chrooted SFTP is that the chroot target must be owned by root. That is essential to ensure that the chroot remains separate. However it also means that you have to plan the directory substructure a little for the chroot.
 
Old 12-11-2023, 09:24 PM   #4
JJJCR
Senior Member
 
Registered: Apr 2010
Posts: 2,167

Rep: Reputation: 449Reputation: 449Reputation: 449Reputation: 449Reputation: 449
Agree with the chrooted SFTP account.

Search the web with keyword below and create a Test VM and check whether it satisfies with your goal before rolling out to Production:

Quote:
Create a directory and change permission accordingly:
sudo mkdir /srv/sftp/sftpuser
sudo chown root:sftpgroup /srv/sftp/sftpuser
sudo chmod 755 /srv/sftp/sftpuser

sudo nano /etc/ssh/sshd_config

try the settings below:

Subsystem sftp internal-sftp
Match Group sftpgroup
ChrootDirectory /srv/sftp/
change the group name and the path accordingly, add the user that will be chrooted to the sftpgroup
 
  


Reply

Tags
ftp



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to proxy ftp packets between IPV4 ftp server and an IPV6 ftp client? Neeraj0019 Linux - Networking 5 11-16-2021 11:15 AM
Rhel 7.3 lsblk showing output rhel-pool00_tmeta rhel-pool00_tdata Pravingoud89 Red Hat 7 12-27-2018 10:52 AM
what is a main difference between rhel 6 and rhel 7 accourding to rhel exam bikesh Linux - Newbie 6 12-05-2014 12:06 AM
Upgrade to RHEL 5.3 from RHEL 4.4 only using the kernel rpm of RHEL 5.3 rhystech Red Hat 4 05-28-2012 10:01 PM
RHEL 3 ES vs RHEL 4 ES vs RHEL 5 ES sweetcorn Linux - Enterprise 6 11-03-2008 01:27 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 06:46 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration