Linux, allow SFTP only users (with shared and chroot-ed env)

Users must upload/download files only via sftp/scp (no ssh, local login) to a pre-defined directory.

Users must not browse other directories or list directory tree.

Multiply users may share single directory (e.g. list of users assotiated with particular organization)

1. Creating of local users and home/upload dir structure

adduser --no-create-home --home /opt/sftp/chroot/org1 --shell /bin/nosuch u1

adduser --no-create-home --home /opt/sftp/chroot/org1 --shell /bin/nosuch u2

addgroup sftp

adduser u1 sftp

adduser u2 sftp

mkdir -p /opt/sftp/chroot/org1/upload

chmod -R 0755 /opt/sftp/chroot/org1  # 755 is must

chown -R root:root /opt/sftp/chroot/org1 # owner=root is must

chgrp sftp /opt/sftp/chroot/org1/upload

chmod 0764 /opt/sftp/chroot/org1/upload

2. Edit sshd_config (after UsePAM yes)

Subsystem sftp internal-sftp -l VERBOSE -f LOCAL3 # VERBOSE and LOCAL3 are used for logging via rsyslog.d/sftp.log

Match Group sftp # only users members of sftp group are allowed

ChrootDirectory %h # chrooted to $HOME_DIR e.g. /opt/sftp/chroot/org1

 AllowTcpForwarding no

 X11Forwarding no

 ForceCommand internal-sftp  -l VERBOSE -f AUTHPRIV # force to use only sftp/scp but not ssh -> shell=/bin/such helps too

service sshd restart

3. Update rsyslog configuration by editing /etc/rsyslog.d/sftp_log.conf

input(type="imuxsock" Socket="/opt/sftp/chroot/org1/dev/log" CreatePath="on")

local3.*                                                /var/log/sftp_org1.log

AUTHPRIV.*                                                /var/log/sftp_org1.log

4. Test 

tail -n 20 /var/log/sftp_org1.log

Apr  5 17:42:53 vs sshd[32700]: pam_unix(sshd:session): session opened for user u1 by (uid=0)

Apr  5 17:42:54 vs internal-sftp[32723]: session opened for local user u1 from [1.2.3.4]

Apr  5 17:42:54 vs internal-sftp[32723]: received client version 3

Apr  5 17:42:54 vs internal-sftp[32723]: realpath "."

Apr  5 17:43:04 vs internal-sftp[32723]: realpath "/up"

Apr  5 17:43:05 vs internal-sftp[32723]: stat name "/up"

Apr  5 17:43:06 vs internal-sftp[32723]: opendir "/up"

Apr  5 17:43:06 vs internal-sftp[32723]: closedir "/up"

Apr  5 17:43:19 vs internal-sftp[32723]: opendir "/up/"

Apr  5 17:43:19 vs internal-sftp[32723]: closedir "/up/"

Apr  5 17:43:19 vs internal-sftp[32723]: lstat name "/up/file1.txt"

Apr  5 17:43:20 vs internal-sftp[32723]: remove name "/up/file1.txt"

Apr  5 17:43:23 vs internal-sftp[32723]: open "/up/file2.sftp" flags WRITE,CREATE,TRUNCATE mode 0644

Apr  5 17:43:23 vs internal-sftp[32723]: close "/up/file2.sftp" bytes read 0 written 854

Apr  5 17:43:27 vs internal-sftp[32723]: lstat name "/up/file2.sftp"

Apr  5 17:43:27 vs internal-sftp[32723]: stat name "/up/file2.sftp"

Apr  5 17:43:27 vs internal-sftp[32723]: open "/up/file2.sftp" flags READ mode 0666

Apr  5 17:43:27 vs internal-sftp[32723]: close "/up/file2.sftp" bytes read 854 written 0

Apr  5 17:43:36 vs internal-sftp[32723]: session closed for local user u1 from [1.2.3.4]

Apr  5 17:43:36 vs sshd[32700]: pam_unix(sshd:session): session closed for user u1

Proftpd & FileZilla troubles

Като допълнение на това: FTP access-2
[ Нещата явно са се случили след ъпдейта от Debian 6 към Debian 7 Поне нищо друго не ми хрумва ]
Като цяло оплакването, е че не работи FTP съръвъра... в частност - не работи през FileZilla
Status:    Connection established, waiting for welcome message...
Response:    220 DMT FTP Server
Command:    USER down
Response:    331 Password required for down
Command:    PASS ****
Response:    230 Anonymous access granted, restrictions apply
Command:    OPTS UTF8 ON
Response:    200 UTF8 set to on
Status:    Connected
Status:    Retrieving directory listing...
Command:    PWD
Response:    257 "/" is the current directory
Command:    TYPE I
Response:    200 Type set to I
Command:    PORT 194,12,234,123,242,221
Response:    200 PORT command successful
Command:    MLSD
Error:    Connection closed by server
Error:    Failed to retrieve directory listing

Драмата е в новите версии на proftpd (явно над proftpd -v ProFTPD Version 1.3.4a) и по-специално в mod_facts.c
Текущата версия е :  proftpd -vv | grep facts -->   mod_facts/0.3 (* $Id: mod_facts.c,v 1.45 2011/05/23 21:11:56 castaglia)
докато старата е : proftpd -vv | grep facts -->   mod_facts/0.1 ($Id: mod_facts.c,v 1.26.2.1 2010/03/02 18:08:07 castaglia)

Решението на проблема е :
< IfModule mod_facts.c > 
FactsAdvertise off 
</IfModule > 
добавено в /etc/proftpd/proftpd.conf.

Описанието:  
1. http://www.proftpd.org/docs/modules/mod_facts.html
2. https://forum.filezilla-project.org/viewtopic.php?f=2&t=22464&start=0