[scponly] trouble logging in to scponly v.4.8 user using sftp
Formal Disorder
glm at cyborgspiders.com
Thu Apr 10 20:02:58 EDT 2008
Hello all,
I am wondering where I went wrong. I have created an scponly user with
the following procedure. However, I am unable to login over sftp as the
new created 'make jail' user. I am using OpenBSD 4.2 with Apache 1.3.9
in a chroot of /var/www
The following is an outline of my installation procedure.
decompress scponly-4.8.tgz
$ tar xzpvf scponly-4.8.tgz
$ cd scponly-4.8
3) I want the chroot version (user control) and I want verbose logging
(user monitoring) of each users actions.
$ ./configure --enable-chrooted-binary --enable-sftp-logging-compat
$ make
$ sudo make install
4) Edit /etc/shells adding the full chroot pathname to scponlyc
full chroot pathname = /usr/local/sbin/scponlyc
5) Add a user that is restricted to the scponlyc shell.
# adduser
Enter username []: scponlychroot
Enter full name []: Scopi Onli
Enter shell csh ksh nologin scponlyc sh [ksh]: scponlyc
Uid [1001]:
Login group scponlychroot [scponlychroot]:
Login group is ``scponlychroot''. Invite scponlychroot into other
groups: guest no [no]:
Login class authpf daemon default staff [default]:
enter password: hardtoguess
output =
Name: scponlychroot
Password: ****
Fullname: Scopi Onli
Uid: 1001
Gid: 1001 (scponlychroot)
Groups: scponlychroot
Login Class: default
HOME: /home/scponlychroot
Shell: /usr/local/sbin/scponlyc
OK? (y/n) [y]:
6) Make the /home/scponlychroot folder read only
# chmod 444 /home/scponlychroot
then I edited /var/www/conf/httpd.conf to include
UserDir /var/www/users
<Directory /users/*>
AllowOverride FileInfo AuthConfig Limit
Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
<Limit GET POST OPTIONS PROPFIND>
Order allow,deny
Allow from all
</Limit>
<Limit PUT DELETE PATCH PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
Order deny,allow
Deny from all
</Limit>
</Directory>
$ cd scponly-4.8
$ sudo make jail
username: rebels
home directory you wish to set for this user [/home/rebels]
/var/www/users/rebels
name of the writeable subdirectory [incoming]
And then for good measure added the new user to the sftp Subsystem in
/etc/ssh/sshd_config
$ sudo vi /etc/ssh/sshd_config
# override default of no subsystems
Subsystem sftp /usr/libexec/sftp-server
AllowUsers rebels
The problem:
When I attempt to sftp rebels at ipaddress I get a prompt, enter the
passphrase and am immediately booted out. Message = connection closed.
Where did I go wrong? Please advise.
More information about the scponly
mailing list