AWS LightSail – Add SFTP User (Part 2)

Word Count: 158
  • Post category:Servers
  • Post last modified:2024-03-24

Introduction

Part 1 of this article describes the methods to install a SFTP user on the LightSail instance. However, this user can still access files and directories in the whole system where access right is granted to this user. A better apprach is to limit this user to have access only to the chroot directory (i.e., /bitnami). This is done by setting up ChrootDirectory and ForceCommand in the sshd configuration file. By doing so, the sftpuser can only access the the system via SFTP but unable to login using SSH (putty) anymore.

The Processes

  • Follow all steps in Part 1 to set up the new user with SFTP access.
  • Edit the sshd config file to include a ‘Match User’ block
    • sudo nano /etc/ssh/sshd_config
    • add below code to the very bottom of the file
Match User sftpuser
        ForceCommand internal-sftp
        ChrootDirectory /bitnami/
        PermitTunnel no
        AllowTcpForwarding no
        X11Forwarding no
  • Restart SSH
    • sudo systemctl restart sshd

Reference

Tags: , , ,