Centos – Chrooted SFTP user – Write permission denied even for owner

centoschrootpermissionssftp

On CentOS release 6.5 (Final) I created a restricted user test1

useradd -s /bin/false test1

and configured ssd_config as following

Subsystem sftp internal-sftp

Match User test1
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no

defined home directory for user test1

usermod -d /usr/local/tomcat/webapps/ROOT

then

chown root:root /usr/local/tomcat/webapps/ROOT
chown test1:test1 -R /usr/local/tomcat/webapps/ROOT/*
chmod 755 -R /usr/local/tomcat/webapps/ROOT/*

restarted sshd and tried to log into sftp

# sftp test1@localhost
Connecting to localhost...
test1@localhost's password:

sftp> ls -la
drwxr-xr-x    9 0        0            4096 Feb 16 08:20 .
drwxr-xr-x    9 0        0            4096 Feb 16 08:20 ..
drwxr-sr-x    2 500      501          4096 Feb  6 10:37 META-INF
drwxr-sr-x    6 500      501          4096 Feb 12 14:07 WEB-INF
drwxr-sr-x    2 500      501          4096 Feb 16 08:13 css
drwxr-xr-x    2 500      501          4096 Feb 16 08:27 home
drwxr-sr-x    3 500      501          4096 Feb 12 14:13 images
drwxr-sr-x    2 500      501          4096 Feb 16 00:37 js

sftp> mkdir css/test
Couldn't create directory: Permission denied

I have tried almost everything but still can not figure out why the owner of directory does not have write permission?

Best Answer

I think you need to enable some selinux bool, for more information about a selinux bools of a service, you can type from your shell man sftpd_selinux

 [root@worktux ~]# getsebool -a | grep sftp
 sftpd_anon_write --> off
 sftpd_enable_homedirs --> off
 sftpd_full_access --> off
 sftpd_write_ssh_home --> off

Related Solutions

Linux – write permission denied via filezilla sftp to /var/www/html

If you are using Ubuntu the Apache user will be www-data, but if you are using CentOS the webserver user will be Apache, so can you grep and see whether Apache user exist or not:

grep apache /etc/passwd

If the apache user exist you can use :

chown -R apache:apache /var/www/html

SFTP – How to Log to a Separate File for Chrooted User

According to this link I believe you meet one of three criteria for having detailed logging of chrooted sftp users:

detailed logging must be configured in the sftpd config. You appear to have done so using the "ForceCommand internal-sftp -l INFO" directive.
a log file must be specified inside of the chrooted directory, as a chrooted user does not have permission to write to the /var/log directory.
a logging socket must be added to rsyslogd to facilitate logging to the new log file.

Comparing other links such as this generic instruction and this CentOS instruction it appears that the exact configuration varies slightly between distros with regards to preferred custom directory names for the logging path, the exact file where to place the logging socket config and the expression of the logging socket config.

[EDIT] Mon Dec 30 21:50:00 GMT 2013

I don't have access to a CentOS at the moment but found what appears to be an excellent guide in a link in the CentOS-page above. The link is broken but I could access the page through the Waybackmachine. But as the guide seems at risk of disappearing, I'm now going to blatantly copy the parts relevant to your questions in a magnificent quote below. Hopefully it will help you, but as said at the moment I have no means of testing on the distro you use.

It appears you have done some things differently, so fingers crossed you will strike gold below.

--Start quote from bigmite.com in Waybackmachine--

Chroot Configuration

In this example I am going to set up a group of users that require SFTP access only (no SSH) and are going to copy files to a filesystem on a SFTP server. The location of the filesystem is going to be /sftp and users will reside in seperate folders under here.

Initially a new group should be created, here called “sftpuser”. Each user that requires SFTP access will be placed in this group.

The sshd_config (on debian in /etc/ssh) should be edited and the following added on the end:-

Match group sftpuser
 ChrootDirectory /sftp/%u
 X11Forwarding no
 AllowTcpForwarding no
 ForceCommand internal-sftp -l VERBOSE -f LOCAL6

This does the following:-

Forces all users connecting via ssh on port 22 to have sftp only
Runs their sftp session in a chroot jail in directory /sftp/$USER
Prevents them TCP of X11 forwarding connections
Runs the internal sftp server getting it to log verbose and to syslog channel name LOCAL6

Now a user should be created, without creating a home directory and in the default group sftpuser. On ubuntu you can enter:-

(Line break added by me for readability! /E)

adduser --home / --gecos "First Test SFTP User" --group sftpuser --no-create-home
--shell /bin/false testuser1

The reason the home directory is set to / is that the sftp will chroot to /sftp/testuser1. Next the users home directory will need creating:-

mkdir /sftp/testuser1
chmod 755 /sftp/testuser1
mkdir /sftp/tstuser1/in
mkdir /sftp/testuser1/out
chown testuser1 /sftp/testuse1/in

Note that the directory structure and permissions that you set may differ depending on your requirements. The users password should be set, and sshd restarted (on debian service ssh restart).

Now it should be possible to sftp files to the host using the command line sftp tool, but it should not be possible to ssh to the server as user testuser1.

Logging

You will see verbose sftp logging being produced in the /var/logmessages for each chroot’ed user, where by default this should go to the daemon.log. The reason for this is that the chroot’ed sftp process can not open /dev/log as this is not within the chrooted filesystem.

There are two fixes to this problem, depending on the filesystem configuration.

If the users sftp directory /sftp/user is on the root filesystem

You can create a hard link to mimic the device:-

mkdir /sftp/testuser1/dev
chmod 755 /sftp/testuser1/dev
ln /dev/log /sftp/testuser1/dev/log

If the users sftp directory is NOT on the root filesystem

First syslog or rsyslog will need use an additonal logging socket within the users filesystem. For my example /sftp is a seperate sftp filesystem.

For Redhat

On redhat syslog is used, so I altered /etc/sysconfif/syslog so that the line:-

SYSLOGD_OPTIONS="-m 0"

reads:-

SYSLOGD_OPTIONS="-m 0 -a /sftp/sftp.log.socket

Finally the syslog daemon needs to be told to log messages for LOCAL6 to the /var/log/sftp.log file, so the following was added to /etc/syslog.conf:-

# For SFTP logging
local6.*                        /var/log/sftp.log

and syslog was restarted.

For Ubuntu Lucid

On Ubuntu lucid I created /etc/rsyslog.d/sshd.conf containing:-

# Create an additional socket for some of the sshd chrooted users.
$AddUnixListenSocket /sftp/sftp.log.socket
# Log internal-sftp in a separate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~

… and restarted rsyslogd.

Creating log devices for users

Now for each user a /dev/log device needs creating:-

mkdir /sftp/testuser1/dev
chmod 755 /sftp/testuser1/dev
ln /sftp/sftp.log.socket /sftp/testuser1/dev/log

--End quote--