sftp服务
**
Sftp服务
**
一. 创建根目录和组
[root@localhost ~]# mkdir /sftp/data -p -m 755
[root@localhost ~]# useradd -g sftp -s /bin/false wei
二. 设置属主权限
[root@localhost ~]# groupadd wei
[root@localhost ~]# chown root:wei /sftp/data/
三. 服务配置
[root@localhost ~]# vim /etc/ssh/sshd_config
# Subsystem sftp /usr/lib/openssh/sftp-server # 注释下边这行掉
Subsystem sftp internal-sftp ## 使用系统默认的sftp服务
Match User wei #这行用来匹配用户
ChrootDirectory /sftp/data #用chroot将用户的根目录指定到/sftp/data，这样用户就只能在/sftp/data下活动
AllowTcpForwarding no # 禁用端口转发
X11Forwarding no
ForceCommand internal-sftp # 强制执行内部SFTP,并忽略任何~/.ssh/rc中的命令
四. 重启sshd–>报错
[root@localhost ~]# systemctl restart sshd
Job for sshd.service failed because the control process exited with error code. See "systemctl status sshd.service" and "journalctl -xe" for details.
[root@localhost ~]# systemctl status sshd -l
● sshd.service - OpenSSH server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Tue 2019-01-15 08:50:29 CST; 3s ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 114276 ExecStart=/usr/sbin/sshd -D $OPTIONS (code=exited, status=255)
Main PID: 114276 (code=exited, status=255)
Jan 15 08:50:29 localhost.localdomain systemd[1]: Starting OpenSSH server daemon...
Jan 15 08:50:29 localhost.localdomain sshd[114276]: /etc/ssh/sshd_config line 161: Directive 'Protocol' is not allowed within a Match block
Jan 15 08:50:29 localhost.localdomain systemd[1]: sshd.service: main process exited, code=exited, status=255/n/a
Jan 15 08:50:29 localhost.localdomain systemd[1]: Failed to start OpenSSH server daemon.
Jan 15 08:50:29 localhost.localdomain systemd[1]: Unit sshd.service entered failed state.
Jan 15 08:50:29 localhost.localdomain systemd[1]: sshd.service failed.
解决方案：sftp配置放到文件最后边
Subsystem sftp internal-sftp
Match User wei
ChrootDirectory /sftp/data
AllowTcpForwarding no
ForceCommand internal-sftp
五. 客户端测试
linux-blof:~ # sftp [email protected]
no matching mac found: client hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 server hmac-sha2-256,hmac-sha2-512
Couldn't read packet: Connection reset by peer
解决方案：在服务端/etc/ssh/sshd_config中添加
第一行
KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchan ge-sha1,diffie-hellman-group14-sha1
第二行
Ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-c bc
第三行
MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-sha1-96,hmac-md5-96
第四行
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-s ha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,[email protected]
注意注释掉之前的MACs行
重启ssh服务即可
客户端在测试
如果你链接服务器的时候出现下面的提示：
Write failed: Broken pipe
Couldn’t read packet: Connection reset by peer
这个问题的原因是ChrootDirectory的权限问题，你设定的目录必须是root用户所有，否则就会出现问题。所以请确保sftp用户根目录的所有人是root, 权限是 750 或者 755。注意以下两点原则：
目录开始一直往上到系统根目录为止的目录拥有者都只能是 root，用户组可以不是 root。
目录开始一直往上到系统根目录为止都不可以具有群组写入权限