Introduction

The AWS LightSail instance provides a default STFP access using the bitnami account. To provide access to other developers with less previlages than bitnami, it is desirable to create another user to perform the SFTP access.

The Processes

• Log into the LightSail instance using the bitnami account
• Add a new user, say ‘sftpuser’ in this case, and also add this user to Group daemon:
  • sudo useradd -s /bin/bash -m sftpuser
  • sudo usermod -a -G daemon sftpuser
• Create public and private key files for the user:
  • sudo mkdir -p /home/sftpuser/.ssh
  • cd /home/sftpuser/.ssh
  • sudo ssh-keygen
    • file to save => /home/sftpuser/.ssh/sftpuserkey
    • no passphrase needed
• Transfer content of public key to the stardard file:
  • sudo bash -c 'cat sftpuser.pub >> authorized_keys'
• Change permissions and ownerships of key files:
  • sudo chmod 700 /home/sftpuser/.ssh
  • sudo chmod 600 /home/sftpuser/.ssh/authorized_keys
  • sudo chown -R sftpuser:sftpuser /home/sftpuser/.ssh
• Move the sensitive private key to the more secure /home/bitnami and add the extension ‘.pem’
  • sudo mv sftpuser /home/bitnami/sftpuserkey.pem
  • sudo chmod 660 /home/bitnami/sftpuserkey.pem
  • sudo chown sftpuser:bitnami /home/bitnami/sftpuserkey.pem
• Use the bitnami SFTP account to download the private key to the local PC for setting up SFTP access for user sftpuser.

Points to note

The above approach sets up SFTP access to all files and directories in the system the have the access granted for the sftpuser account. In Part 2, steps are provided for restricting the access to the wordpress directory only.

Reference

The above processes are based on the video below with modifications.