Home / server / Questions / 231579
Accepted
Doron
Asked: 2011-02-06 07:03:29 +0800 CST

How do I set up an sftp user to login with a password to an EC2 ubuntu server?

  • 772

I have an Ubuntu Server running on an EC2 instance. To login to that server I use a certificate file without any password.

I've installed and configured vsftpd and created a user (let's call him "testuser") for which I've set a /bin/false ssh terminal so it will only be able to connect via sftp and upload/access files on his home directory.

However - when I try to connect to the server from my computer, running

sftp testuser@my-ec2-server

I get

Permission denied (publickey).
Connection closed

messages so I can't log in.

How can I remove the certificate requirement for this user only (meaning, the "ubuntu" user will still have to use the certificate file to login via ssh), so normal sftp clients will be able to connect using a username and a password ?

Thank you.

PS Using Ubuntu Server 10.10 official AMI from canonical, 64bit on a micro instance.

ubuntu cloud-computing sftp certificate

2 Answers

  1. Best Answer

    In order to accomplish what you wish, you need to do two different things

    1. Change sshd config to accept passwords

    I shall say first of all that it's a bad idea to do this, I would rather generate a certificate for your user than activate passwords, nonetheless if you want to do so just edit /etc/ssh/sshd_config and change or uncomment it so it shows PasswordAuthentication yes. Once that is done restart sshd service ssh restart

    1. Let users just FTP using sftp and not have shell

    In order to acomplish that you need to install rsh (resticted shell) and change the user shell to it chsh username

    • 15

  2. Here is a step by step guide to allow:

    1. SFTP access to /home/bob/uploads for user bob
    2. Lock bob out of SSH
    3. Use username/passwords rather than keys:

    First, edit your /etc/ssh/sshd_config file:

    sudo nano /etc/ssh/sshd

    Scroll down and modify:

    PasswordAuthentication yes

    and add this at the bottom:

    Match Group sftpusers
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no

    Press Ctrl-X to exit and save.

    Now add the user:

    sudo useradd bob
sudo passwd bob

    Now add the groups and disable ssh:

    sudo groupadd sftpusers
sudo usermod  -g sftpusers bob
sudo usermod -s /usr/bin/rssh bob
sudo usermod -d /home/bob bob

    Now set permissions:

    sudo chown root:root /home/bob/
sudo chmod 755 /home/bob/
sudo mkdir /home/bob/uploads
sudo chown bob /home/bob/uploads

sudo service sshd restart

    All this is while logged in as a root user (ec2-user on Amazon Linux AMIs)

    • 1