On 12 March 2010 08:27, Olivier Nicole <olivier.nic...@cs.ait.ac.th> wrote:

> Hi,
>
> > I need to have ftp access to a machine. I've found pure-ftpd but it was
>
> Hummm, you want the short answer? Don't enable ftp :)
>
> Ftp only accepts plain text passwords (until you enable things like
> kerebos, one time password, etc), so it is not, it cannot be, secure.
>
> SFTP is there, working easily, ready to use, with a decent Windows
> client WinSCP (winscp.net)
>
> Best regards,
>
> Olivier
> _______________________________________________
> freebsd-questions@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "
> freebsd-questions-unsubscr...@freebsd.org"
>

enable sftp in ssh and chroot all the users and make the sftp only accounts

I wrote this guide for work a year or so ago. It was for solaris but it was
using openssh so should work fine on bsd


   1. Dont bother with sun ssh it wont work. Opensolaris and later solaris
   10 are bundled with openssh though.
   2. Make sure openssh version is 5 or above (some 4s do work but 5 better)
   3. Add these lines to sshd config

   Match Group sftponly
            ChrootDirectory /home/chroot/%u
            X11Forwarding no
            AllowTcpForwarding no
            ForceCommand internal-sftp

    4. Make sure the Subsystem line is this

   Subsystem       sftp    internal-sftp

    5. create the sftponly group on the system
   6. put the relevent users in this group. be careful as you will stop them
   being able to ssh in!!
   7. Dead important this bit !!!

   mkdir -p /home/chroot/<user>/home/<user>/.ssh
   chown -R root /home/chroot/<user>
   chown -R <user> /home/chroot/<user>
   chmod -R 755 /home/chroot/<user> /home/chroot/<user>/home/<user>
   ln -s /home/chroot/<user>/home/<user> /home/.

    8. Put their ssh keys in /home/chroot/<user>/home/<user>/.ssh

 All should now work
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Reply via email to