CentOS 6 with chrooted SFTP-only users + SSH hardening
Having a new server deployment to do, I wanted to take some time to get a working OpenSSH implementation under CentOS 6 to allow for SFTP-only users in a chrooted environment. This process is rather simple (these days) and here’s both my sshd_config file as well as some other notes to help you along your way as well.
You’ll note some of the restrictions are excessive for most people but for my implementation the crypto overhead is fine.
/etc/ssh/sshd_config
AddressFamily inet #ListenAddress 0.0.0.0 Protocol 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key KeyRegenerationInterval 1h ServerKeyBits 4096 SyslogFacility AUTHPRIV LogLevel VERBOSE LoginGraceTime 1m PermitRootLogin no StrictModes yes MaxAuthTries 4 MaxSessions 5 PasswordAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys RSAAuthentication no IgnoreRhosts yes RhostsRSAAuthentication no HostbasedAuthentication no PermitEmptyPasswords no ChallengeResponseAuthentication no KerberosAuthentication no GSSAPIAuthentication no UsePAM yes Ciphers aes256-ctr,aes256-cbc MACs hmac-sha1 AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS AllowAgentForwarding no AllowTcpForwarding no GatewayPorts no X11Forwarding no PrintMotd no PrintLastLog no TCPKeepAlive yes UsePrivilegeSeparation yes ClientAliveInterval 300 ClientAliveCountMax 0 ShowPatchLevel no UseDNS yes PidFile /var/run/sshd.pid MaxStartups 20 PermitTunnel no Subsystem sftp internal-sftp Match Group sftpusers ChrootDirectory /home/%u PasswordAuthentication no ForceCommand internal-sftp
ServerKeyBits Note If you change your ServerKeyBits be sure to purge your existing keys (/rm /etc/ssh/ssh_host_*) and restart sshd to allow them to regenerate.
Configure proper permissions
chown root:root /home/[username] chmod 711 /home/[username]
Setup the .ssh directory
mkdir /home/[username]/.ssh chown root:sftpusers /home/[username]/.ssh chmod 750 /home/[username]/.ssh
Setup the authorized_keys file
touch /home/[username]/.ssh/authorized_keys chown root:sftpusers /home/[username]/.ssh/authorized_keys chmod 440 /home/[username]/.ssh/authorized_keys
Create a directory accessible by the user
mkdir /home/[username]/storage chown [username]:[username] /home/[username]/storage chmod 760 /home/[username]/storage
Note, you’ll likely want to generate a public/private SSH keypair (ssh-keygen -t rsa) for the user and ensure permissions are as they should be above. This must be done unless you re-enable password authentication.
