SFTP help on Ubuntu

[sup3rcarrx7]

Hi guys,

I just created a SFTP server on Ubuntu 16.04.1 LTS that will be accessed both internally and externally for file transfers from following the guide found at the Linod link below.
Limiting Access with SFTP Jails on Debian and Ubuntu <meta property=


There are 2 other issues I now need to resolve before I make it 'live' for actual usage.

1. How do i disable SSH access via putty, terminal, etc. both internally and externally?
2. Is there a quick way to configure the ports on the system to only allow port 22 for SFTP and block all other ports?
3. How do I make it so that when you log in with the SFTP account, it starts on a dedicated directory only. I don't want the system folders etc. to be shown.

Thanks in advance!

 

[FnordMan]

Hi guys,

I just created a SFTP server on Ubuntu 16.04.1 LTS that will be accessed both internally and externally for file transfers from following the guide found at the Linod link below.
Limiting Access with SFTP Jails on Debian and Ubuntu <meta property=


There are 2 other issues I now need to resolve before I make it 'live' for actual usage.

1. How do i disable SSH access via putty, terminal, etc. both internally and externally?
2. Is there a quick way to configure the ports on the system to only allow port 22 for SFTP and block all other ports?
3. How do I make it so that when you log in with the SFTP account, it starts on a dedicated directory only. I don't want the system folders etc. to be shown.

Thanks in advance!

Google knows all..
The very first link....
#2 isn't really possible as far as I know.

 

[Stugots]

The user you're logging in with, make its shell nologin. That should prevent a shell from being started when you login with SSH. SFTP should still work. I think.

You'll need a local firewall to only allow TCP port 22.

And you'll need to change the home folder of the user your connecting over SFTP to whatever you like.

 

[darkeen]

#2 can be done via firewalling. Look into iptables or firewalld (I'm not sure which ubuntu is using). Just drop all packets that don't go to port 22. iptables has an inverse rule (-i iirc) so you can write a block only port 22 rule then invert it. This will allow any protocol on port 22, but your ftp server will be bound to that port so nothing else can use it.

#3 Can be done, but is a ftp server specific and you'll need to read the appropriate docs for your specific server.

 

[B00nie]

#2 can be done via firewalling. Look into iptables or firewalld (I'm not sure which ubuntu is using). Just drop all packets that don't go to port 22. iptables has an inverse rule (-i iirc) so you can write a block only port 22 rule then invert it. This will allow any protocol on port 22, but your ftp server will be bound to that port so nothing else can use it.

#3 Can be done, but is a ftp server specific and you'll need to read the appropriate docs for your specific server.

Ubuntu uses ufw (uncomplicated firewall) which is super easy to use.

You should not leave port 22 open, every port scanner on this planet are attacking it. Move your SSH port to 2222 or something other in the free port space.

 

[Stugots]

You should not leave port 22 open, every port scanner on this planet are attacking it. Move your SSH port to 2222 or something other in the free port space.

Forgot about that.

You'll eliminate 98% of people hitting your server by simply doing that.

 

[sup3rcarrx7]

Thanks for the suggestions guys. My colleague was able to getting all 3 figured out with the Chroot and Match User/Group commands in modifying the sshd_config file. We basically denied root SSH access and denied remaining users SSH access in the config file. We also used ufw to deny all ports except allowing port 22

 

[B00nie]

Thanks for the suggestions guys. My colleague was able to getting all 3 figured out with the Chroot and Match User/Group commands in modifying the sshd_config file. We basically denied root SSH access and denied remaining users SSH access in the config file. We also used ufw to deny all ports except allowing port 22

But why did you leave it on port 22? You're getting hammered with attacks for no reason.