D
D
danforth2017-10-16 06:11:26
SSH
danforth, 2017-10-16 06:11:26

How to make authentication for sFTP (ssh) user by key file?

Hello!
Installed NGINX, folder with hosts /var/www/html/site.ru/.
Added to /etc/ssh/sshd_config at the end:

Match User ftp
ForceCommand internal-sftp
PasswordAuthentication yes // хочу сделать no
#AuthorizedKeysFile /home/danforth/.ssh/sftp_authorized_keys // путь к файлу с публичным ключем
ChrootDirectory /var/www/
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no

The home directory for the ftp user is /var/www.
When I specify the path to the file, I get the following error in FileZilla:
Disconnected: No supported authentication methods available (server sent: publickey)
If I comment it back and enable password authentication, then everything is OK, it connects.
The file /home/danforth/.ssh/sftp_authorized_keysis ftp owner and group, and has read/write access only.
I also tried following this manual: https://wiki.archlinux.org/index.php/SFTP_chroot#F...
What could be the problem and how to specify the path to the public key file?
upd.1: Notice
the following in the logs:
Oct 16 12:52:17 quasar sshd[23847]: User ftp authorized keys /etc/ssh/authorized_keys/ftp is not a regular file

The current config is:
Match User ftp
ForceCommand internal-sftp
PasswordAuthentication no
AuthorizedKeysFile /etc/ssh/authorized_keys/%u .ssh/authorized_keys
ChrootDirectory /var/www/
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no

The path to the file is as follows:
/etc/ssh/authorized_keys/ftp/.ssh/authorized_keys
I tried to write the following in AuthorizedKeysFile:
/etc/ssh/authorized_keys/ftp/.ssh/authorized_keys
/etc/ssh/authorized_keys/ftp/
/etc/ssh/authorized_keys/%u/
It did not help.

Answer the question

In order to leave comments, you need to log in

2 answer(s)
D
danforth, 2017-10-16
@danforth

In general, it worked with the following config:
namei -mo /etc/ssh/authorized_keys/ftp/.ssh/authorized_keys

drwxr-xr-x root root .
 drwxr-xr-x root root authorized_keys
 drwxr-xr-x ftp  ftp  ftp
 drwx------ ftp  ftp  .ssh
 -rw------- ftp  ftp  authorized_keys

In config:
Match User ftp
ForceCommand internal-sftp
PasswordAuthentication no
AuthorizedKeysFile /etc/ssh/authorized_keys/ftp/.ssh/authorized_keys
ChrootDirectory /var/www/
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no

In this version, it started up, apparently there was something with the rights.

R
res2001, 2017-10-16
@res2001

1.The key file must be named authorized_keys.
I did not use the method described in the link.
2. access to the key should be only for the owner.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question