I have an FTP server that authenticates via an API and has user folders in:


Some users have requested SFTP instead and since I already have processes in place to put files in the user's directory, I figure I can just create accounts for the users.

useradd -g sftpgroup -d /home/ftpusers/files/username/ -s /sbin/nologin username
mkdir -p /home/ftpusers/files/username/.ssh
chown -R username:ftpgroup /home/ftpusers/files/username
chmod -R 770 /home/ftpusers/files/username
echo "ssh-rsa user key" > /home/ftpusers/files/username/.ssh/authorized_keys
chown username:sftpgroup /home/ftpusers/files/username/.ssh
chmod 700 /home/ftpusers/files/username/.ssh
chown username:sftpgroup /home/ftpusers/files/username/.ssh/authorized_keys
chmod 600 /home/ftpusers/files/username/.ssh/authorized_keys

the ftpgroup is so a system account can place files in the user folder the sftpgroup is to lock this user to just SFTP using:

Match Group sftpgroup
ForceCommand internal-sftp
AllowTCPForwarding no
X11Forwarding no

Unfortunately this doesn't work. No useful error, just:

Permission denied (publickey)

It does work fine though if I create a user in a more standard way in the /home/ directory

Any ideas on why? I know chroot has a lot of permission restrictions. Is this something like that?

Added namei output: Sure thing:

namei -l /home/ftpusers/files/jmandel/.ssh
f: /home/ftpusers/files/jmandel/.ssh
dr-xr-xr-x root    root      /
drwxr-xr-x root    root      home
drwxrwx--- ftpuser ftpgroup  ftpusers
drwxrwx--- ftpuser ftpgroup  files
drwxrwx--- jmandel ftpgroup  jmandel
drwx------ jmandel sftpgroup .ssh

Marked answer below has good information in comment thread


Add to your sshd_config file following directive and restart ssh:

AuthorizedKeysFile /home/ftpusers/files/%u/.ssh/authorized_keys .ssh/authorized_keys

This will tell ssh daemon where to look for public keys.

Personally I don't use authorized_keys for a long time, but using instead
AuthorizedKeysCommand where I call my program that looking in sqlite database user's key and send them back for authentication. This way I prevent users/hackers to use their own keys and such configuration don't disclose place where public keys are located.

  • This makes a lot of sense but it didn't seem to work – Supergibbs Aug 26 '18 at 4:14
  • @Supergibbs Could you add to your question output of: namei -l /home/ftpusers/files/SomeUserName/.ssh ? – Alex Aug 26 '18 at 4:34
  • Sure thing, added above for better formatting – Supergibbs Aug 27 '18 at 15:36
  • Check if user jmandel belonging to the group ftpgroup by running id jmandel – Alex Aug 27 '18 at 15:48
  • It's not because I don't want it to, that would allow jmandel access to other users folders. There is a user in the ftpgroup that places files in various user folders. As a test though, I added jmandel to ftpgroup and it didn't help – Supergibbs Aug 27 '18 at 18:54

Is it really

echo "ssh-rsa user key" > /home/ftpusers/files/username/.ssh/authorized_keys

authorized_keys contains the public key of the people allowed to log in as this userid, so it's different for each userid you create. In theory the users generate their own public/private key pair and give you the public key. You can of course generate the pair yourself and give them the private part, but if anything bad happens they can claim it was done by someone else using their private key.

  • The user provides me with their public key and I use it to create their account – Supergibbs Aug 26 '18 at 4:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.