Complectia's questions

I setup chrooted users on an Amazon Linux development instance to grant them access to the /var/www folder. It was working fine, but after a yum update (November I think), the users can no longer edit/create files and folders in the /var/www directory.

I read this thread: SFTP suddenly failing for chroot accounts on Amazon Linux

...which seems to identify the issue, but was not clear if that was referring to my issue. My chroot still works, but the members of the group can no longer edit files in the /var/www directory. The permissions look correct to me - perhaps I am missing something.

To setup the original chroot, I setup a group sftpusers, edited the sshd_config file, added the users and chrooted them to /var/www.

I created a group called devusers and added the chrooted users to this group and set permissions on the files and directories.

If I disable the chroot, users in the devusers group can edit files fine in /var/www. However, if I chroot them, they can see the files okay, but cannot make edits.

Again, this was working fine until the update. Thoughts?

Here is my SSH version:

OpenSSH_6.6.1p1, OpenSSL 1.0.1k-fips 8 Jan 2015

Here are my permissions:

[root@ip-10-0-28-11 var]# ls -la
drwxr-xr-x 20 root root 4096 Jul 24  2015 .
dr-xr-xr-x 26 root root 4096 Feb 18 17:22 ..
drwxrwxrwt  2 root root 4096 Feb 18 17:21 tmp
drwxr-xr-x  9 root root 4096 Jul 19  2016 www
[root@ip-10-0-28-11 var]#

[root@ip-10-0-28-11 www]# ls -la
drwxr-xr-x  9 root   root   4096 Jul 19  2016 .
drwxr-xr-x 20 root   root   4096 Jul 24  2015 ..
drwxr-xr-x  2 root   root   4096 Jul 19  2016 cgi-bin
drwxr-xr-x  3 root   root   4096 Jul 26  2016 error
drwxrwsr-x 14 apache devusers    4096 Nov 11 20:29 html
drwxr-xr-x  3 root   root   4096 Jul 26  2016 icons

[root@ip-10-0-28-11 html]# ls -la
drwxrwsr-x 14 apache devusers  4096 Nov 11 20:29 .
drwxr-xr-x  9 root   root 4096 Jul 19  2016 ..
drwxrwsr-x  2 apache devusers  4096 Oct  1 00:03 testdir

I am trying to use chroot to setup a user who can login via ssh and limit access to the /var/www directory. The server is on AWS running Amazon Linux 64-bit, openssh installed. I used ssh-keygen to generate the keys.

Before I edit the sshd_config file, I am able to login with the username and private key, user starts in the /home/my-username directory, so the key is valid.

I modified the sshd_config file as follows:

Subsystem sftp internal-sftp

Match User my-username
ChrootDirectory /var/www
ForceCommand internal-sftp
AllowTcpForwarding no
PermitTunnel no
X11Forwarding no

Then I restarted sshd.

The ChrootDirectory /var/www is owned by root:root with no groups having write privileges up to that point in the tree – default Apache install.

When I login with my-username and the key, the session immediately disconnects. I checked /var/log/secure and find this entry:

Nov  3 19:53:51 ip-xxx.xxx.xxx.xxx sshd[2945]: Accepted publickey for my-username from xxx.xxx.xxx.xxx port 61821 ssh2
Nov  3 19:53:51 ip-xxx.xxx.xxx.xxx sshd[2945]: pam_unix(sshd:session): session opened for user my-username by (uid=0)
Nov  3 19:53:51 ip-xxx.xxx.xxx.xxx sshd[2945]: pam_unix(sshd:session): session closed for user my-username

I have read numerous threads in many forums and see different solutions – some of which I’ve tried with no success. I’d like to keep this as simple as possible. The goal is to create a user account for a developer who only needs to upload files to the webserver using WinSCP, in the default case to /var/www/html.

I found this thread – User gets instantly disconnected after connection sucessful on a chrooted SSH - but not sure it relates directly to my issue.

I’m thinking this may have something to do with my PAM configuration. Again, this is pretty much a default install.

Thank you in advance for any direction you can provide.