Sshd Sftp

Openssh Sftp Server Windows
Ssh Sftp Updater Support
Sshd Sftp Chroot
Ssh Sftp Port

Remote operations are done using ssh, scp, and sftp. Key management with ssh-add, ssh-keysign, ssh-keyscan, and ssh-keygen. The service side consists of sshd, sftp-server, and ssh-agent. OpenSSH is developed by a few developers of the OpenBSD Project and made available under a BSD-style license. Public void setupSftpServer SshServer sshd = SshServer.setUpDefaultServer; sshd.setPort(22); sshd.setKeyPairProvider(new SimpleGeneratorHostKeyProvider('hostkey.ser')); List userAuthFactories = new ArrayList; userAuthFactories.add(new UserAuthNone.Factory); sshd.setUserAuthFactories(userAuthFactories); sshd.

There are different ways to lock a user into his home directory. A very special case is to grant sftp-only access, which does not require a full chroot jail to be set up. The sftp subsystem built into openssh allows a simple setup of a user locked into his home directory.

Configure OpenSSH

There are two ways to configure OpenSSH. Individual users can be configured in openssh or (my preferred solution) a group can be created and configured in OpenSSH. This group can then be assigned to the users who should be restricted to sftp only. Edit the /etc/ssh/sshd_config file and include the following section at the end of the file.

The above configuration section (the “Match” block) must be the last configuration item in the config file. Any configuration following a Match block overrides the general settings when the Match conditions are met. In the above example, the two configuration items are only used when the user is part of the “sftponly” user group. The “ChrootDirectory” locks the user into the directory specified as argument. The “%h” represents the user’s home directory, allowing the match pattern to lock each user into his own home directory. The “ForceCommand” ensures that the user cannot trigger any other command, but only enter the “internal-sftp” subsystem.

It is also necessary to configure the sftp subsystem to use “internal-sftp”. Also in the /etc/ssh/sshd_config ensure the following configuration is set. Otherwise the external sftp-server will be used, which can not be found inside the chroot jail of the user.

The configured group needs to exist on the system to assign it to the sftp users. The following command will create this group.

Finally the ssh daemon needs to be restarted to load the new configuration.

Further restricting the account

To ensure the sftp only user is only allowed to use sftp, additional restrictions can be added to the match block.

Some of the most common restrictions are shown in the example above.

AllowTcpForwarding – Deny TCP forwarding which can be used to forward certain ports
PasswordAuthentication – Disable password authentication. The user can only authenticate with any remaining methods, like ssh-keys.
X11Forwarding – Deny X11 forwarding to protect any X11 interaction to the server.

Choose the settings for further restriction of the account based on your needs. In some cases, disabling Password authentication might be required to be disabled.

Preparing the Account

A new sftp only account can now be created and prepared. As described above, the user needs to be assigned to the group used in the Match block.

The “-G” option adds “sftponly” as a supplementary group to the user “user1”. With the “-s” option, the user gets “/sbin/nologin” as shell which denies interactive shell access for the user. This command will automatically (if not instructed otherwise with additional arguments) create a home directory for the user. The permissions of the home directory need to be modified for the chroot jail to work.

The user “root” needs to be set as the owner of the home directory. The group should remain the primary group of the user as the user needs to access the directory. The permission set with the following command should ensure the user “user1” can access the home directory.

Do not set the group’s write permission as it will be checked by ssh during login. The ssh daemon will refuse login attempts with the following error if the write permission is granted.

The permission can either be granted by just adding the read and execute permission to the group as shown in the above command or numerically as “0750” setting implicit permission for user, group and other.

Limitations of this setup

This specific setup has one drawback caused by the fact that the user’s home directory owner is root. The user itself has no write permission to his home directory. So the user can not create new directories or files directly directly in the home directory. Above, the owner of the home directory was set to root to allow the chroot jail to work. That change prevents the user from writing directly into the home directory. Granting the user’s group write permission to the home directory will not be possible.

To allow the user to upload content via sftp, a subdirectory should be created for this purpose. The created directory’s owner will be the user, allowing him to manage files and directories within the subdirectory freely.

The above example creates a directory called “data” in the user’s home directory and changes the owner of it to the user. Now the user can manage data inside this directory. In some web-hosting scenarios the directory is named “public_html”. This allows the user to upload web-content while still being locked into his home directory.

Authorized keys

Openssh Sftp Server Windows

To be able to configure an authorized key for the user, the “.ssh” directory must be created and changed to the correct owner and permission.

With the .ssh directory prepared and owned by the user, the user can upload his key already by himself as needed. For more details about adding a key, see SSH passwordless login with SSH-key.

Test the configuration

To test the configuration, connect with the sftp command line client as shown below.

Depending on the configuration, you will either see the prompt “sftp>” or, if no ssh-key was yet added, you will be prompted for the password of the user.

Verify that the user is locked inside the home directory by checking the current working directory (command: “pwd”) and the directory content (command: “ls”). The users home directory should be represented by “/” indicating the root directory in which the user is locked in.

Should there be any issues with the connection or the acceptance of the ssh-key, the sftp client allows to pass ssh options using the “-o” option.

The above example will try to connect to the server with the ssh log level set to debug. This will provide more details about problems from the client’s perspective.

On the server the log files will provide information about what went wrong. On RedHat based distributions, the related log is “/var/log/secure”. Even the ssh daemon on the server supports the “LogLevel” setting in the /etc/ssh/sshd_config file.

Read more of my posts on my blog at https://blog.tinned-software.net/.

Recently, Microsoft has released a port of OpenSSH for Windows. You can use the package to set up an SFTP/SSH server on Windows.

Installing SFTP/SSH Server
Connecting to the server

Advertisement

In Settings app, go to Apps > Apps & features > Manage optional features.
Locate “OpenSSH server” feature, expand it, and select Install.

Binaries are installed to %WINDIR%System32OpenSSH. Configuration file (sshd_config) and host keys are installed to %ProgramData%ssh (only after the server is started for the first time).

You may still want to use the following manual installation if you want to install a newer version of OpenSSH than the one built into Windows 10.

Download the latest OpenSSH for Windows binaries (package OpenSSH-Win64.zip or OpenSSH-Win32.zip)
As the Administrator, extract the package to C:Program FilesOpenSSH
As the Administrator, install sshd and ssh-agent services:

Allow incoming connections to SSH server in Windows Firewall:
- When installed as an optional feature, the firewall rule “OpenSSH SSH Server (sshd)” should have been created automatically. If not, proceed to create and enable the rule as follows.
- Either run the following PowerShell command as the Administrator:
  Replace C:System32OpenSSHsshd.exe with the actual path to the sshd.exe (C:Program FilesOpenSSHssh.exe, had you followed the manual installation instructions above).
- or go to Control Panel > System and Security > Windows Defender Firewall1 > Advanced Settings > Inbound Rules and add a new rule for port 22.
Start the service and/or configure automatic start:
- Go to Control Panel > System and Security > Administrative Tools and open Services. Locate OpenSSH SSH Server service.
- If you want the server to start automatically when your machine is started: Go to Action > Properties. In the Properties dialog, change Startup type to Automatic and confirm.
- Start the OpenSSH SSH Server service by clicking the Start the service.

These instructions are partially based on the official deployment instructions.

Follow a generic guide for Setting up SSH public key authentication in *nix OpenSSH server, with the following difference:

Create the .ssh folder (for the authorized_keys file) in your Windows account profile folder (typically in C:Usersusername.ssh).2
For permissions to the .ssh folder and the authorized_keys file, what matters are Windows ACL permissions, not simple *nix permissions. Set the ACL so that the respective Windows account is the owner of the folder and the file and is the only account that has a write access to them. The account that runs OpenSSH SSH Server service (typically SYSTEM or sshd) needs to have read access to the file.
Though, with the default Win32-OpenSSH configuration there is an exception set in sshd_config for accounts in Administrators group. For these, the server uses a different location for the authorized keys file: %ALLUSERSPROFILE%sshadministrators_authorized_keys (i.e. typically C:ProgramDatasshadministrators_authorized_keys).

Before the first connection, find out the fingerprint of the server’s host key by using ssh-keygen.exe for each file.

In Windows command-prompt, use:

Replace %WINDIR%System32 with %ProgramFiles%, if appropriate.

In PowerShell, use:

Ssh Sftp Updater Support

Replace $env:WINDIRSystem32 with $env:ProgramFiles, if appropriate.

You will get an output like this:

Sshd Sftp Chroot

Start WinSCP. Login dialog will appear. On the dialog:

Ssh Sftp Port

Make sure New site node is selected.
On New site node, make sure the SFTP protocol is selected.
Enter your machine/server IP address (or a hostname) into the Host name box.
Enter your Windows account name to the User name box. It might have to be entered in the format user@domain if running on a domain.
For a public key authentication:
- Press the Advanced button to open Advanced site settings dialog and go to SSH > Authentication page.
- In Private key file box select your private key file.
- Submit Advanced site settings dialog with the OK button.
For a password authentication:
- Enter your Windows account password to the Password box.
- If your Windows account does not have a password, you cannot authenticate with the password authentication (i.e. with an empty password), you need to use the public key authentication.
Save your site settings using the Save button.
Login using Login button.
Verify the host key by comparing fingerprints with those collected before (see above).