I have an FTP server that authenticates via an API and has user folders in:
Some users have requested SFTP instead and since I already have processes in place to put files in the user's directory, I figure I can just create accounts for the users.
useradd -g sftpgroup -d /home/ftpusers/files/username/ -s /sbin/nologin username mkdir -p /home/ftpusers/files/username/.ssh chown -R username:ftpgroup /home/ftpusers/files/username chmod -R 770 /home/ftpusers/files/username echo "ssh-rsa user key" > /home/ftpusers/files/username/.ssh/authorized_keys chown username:sftpgroup /home/ftpusers/files/username/.ssh chmod 700 /home/ftpusers/files/username/.ssh chown username:sftpgroup /home/ftpusers/files/username/.ssh/authorized_keys chmod 600 /home/ftpusers/files/username/.ssh/authorized_keys
the ftpgroup is so a system account can place files in the user folder the sftpgroup is to lock this user to just SFTP using:
Match Group sftpgroup ForceCommand internal-sftp AllowTCPForwarding no X11Forwarding no
Unfortunately this doesn't work. No useful error, just:
Permission denied (publickey)
It does work fine though if I create a user in a more standard way in the /home/ directory
Any ideas on why? I know chroot has a lot of permission restrictions. Is this something like that?
Added namei output: Sure thing:
namei -l /home/ftpusers/files/jmandel/.ssh f: /home/ftpusers/files/jmandel/.ssh dr-xr-xr-x root root / drwxr-xr-x root root home drwxrwx--- ftpuser ftpgroup ftpusers drwxrwx--- ftpuser ftpgroup files drwxrwx--- jmandel ftpgroup jmandel drwx------ jmandel sftpgroup .ssh
Marked answer below has good information in comment thread