How to securely set up SFTP push?

Question

I am trying to purchase a data stream that is sent hourly/daily/weekly from a data provider. They are telling me that they deliver data via SFTP push. I am concerned with security. What precautions should I take to allow files to get transferred to my server via push?

These are the things that I am assuming I need to do:

1. Create a folder where the files are sent
2. Create an SSH key and user for my server
3. Limit that user access to that one and only folder

Are these correct? I would appreciate a full detailed example of how to set up a secure SFTP push onto my server (linux).

Answer 1

SFTP is more or less "built-in" on standard Linux installs of openssh-server I think. So if you have an SSH server running, you're mostly ready, but:

1. Look at /etc/ssh/sshd.config and make sure at least root can't login using a password (keys only for root). You really should disable password login via SSH entirely and only use keys. Also make sure any forwarding options are disabled.

2. Also consider specifying a group and enabling ChrootDirectory

3. Setup and monitor fail2ban to protect your sshd from repeated password guessing attempts. You will get them. Or consider whitelisting IP addresses if possible, and/or firewalling off IP ranges of countries from which access will not ever be needed.

4. Create an account where the files will be received. If you specified a group for chroot in step 2, specify that group when you add the user.

5. Change this accounts's shell to /sbin/nologin - that way they can't get a shell and are restricted to SFTP only.

6. Create an SSH key for that account.

7. Adjust permissions on the account's home folder such that nothing is writeable but a drop folder where you want to receive the files. You may not need to worry too much about this if you're doing ChrootDirectory.

8. Set a disk quota for this user so the account can't maliciously fill up your disk.

9. Setup a cron job or similar mechanism to periodically scan the folder and copy out files.

Answer 2

4. Whitelist originating I.P.s

and them, for the specific SFTP configuration, it seems this sibling question on serverfault.com has a more complete answer than I'd be able to provide:

https://serverfault.com/questions/354615/allow-sftp-but-disallow-ssh

I reached there trying to figure out how to restrict the login to use the SFTP subsystem only, and not be able to get an ssh-shell - that is "5." anyway.