Public key authorization on sftp chroot directory

Question

I want to add public key authorization to my sftp chroot directory but I allways get:

debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/test/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).
Couldn't read packet: Connection reset by peer

Chroot works because authorization with password is possible. I have other account on this host without chroot and it works with this key. I tried many times, but still it doesn't work.

On server in auth.log there is only: Connection closed by xxx [preauth]

This is my directory:

ls -laR /sftp/
/sftp/:
total 12
drwxr-xr-x  3 root root 4096 May  3 16:55 .
drwxr-xr-x 23 root root 4096 May  3 14:46 ..
drwxr-xr-x  3 root root 4096 May  3 16:45 backup

/sftp/backup:
total 12
drwxr-xr-x 3 root     root      4096 May  3 16:45 .
drwxr-xr-x 3 root     root      4096 May  3 16:55 ..
drwxr-xr-x 3 backup sftpusers 4096 May  3 16:55 incoming

/sftp/backup/incoming:
total 12
drwxr-xr-x 3 backup sftpusers 4096 May  3 16:55 .
drwxr-xr-x 3 root     root      4096 May  3 16:45 ..
drwx------ 2 backup sftpusers 4096 May  3 21:06 .ssh

/sftp/backup/incoming/.ssh:
total 12
drwx------ 2 backup sftpusers 4096 May  3 21:06 .
drwxr-xr-x 3 backup sftpusers 4096 May  3 16:55 ..
-rw------- 1 backup sftpusers  391 May  3 21:06 authorized_keys

My user:

backup:x:1002:1003::/incoming:/usr/sbin/nologin

My ssh config:

Match Group sftpusers
  ChrootDirectory /sftp/%u
  AuthorizedKeysFile  /sftp/backup/incoming/.ssh/authorized_keys
  ForceCommand internal-sftp
  AllowTcpForwarding no
  X11Forwarding no

Please help.

Answer 1

You need to add AuthorizedKeysFile /sftp/%u/.ssh/authorized_keys in your /etc/ssh/sshd_config file. It is better if you added it in the match block.

Answer 2

Stephen Buchanan's answer (which works around RHEL6's inability to set AuthorizedKeys in a Match block) splits keys into /home and contents into /sftp, but it is possible to keep everything together under /home instead.

You do this by creating the user's chroot under their home directory. For example, in sshd_config, set the chroot to /home/<user>/sftp:

Match Group sftphome
  ChrootDirectory /home/%u/sftp
  ForceCommand internal-sftp
  AllowTcpForwarding no
  X11Forwarding no

As before, ensure /home/<user> is owned by root and place .ssh keys in /home/<user>/.ssh such that the user has read permissions. Now create /home/<user>/sftp/home/<user>, with all directories owned by root except for the last <user>, which should be owned by the user. Finally, ensure the user's home directory is /home/<user> in /etc/passwd.

Now when the user logs in, the ssh key is looked up in /home/<user>/.ssh as per /etc/passwd, a chroot is done into /home/<user>/sftp, and then a cd is done into /home/<user> inside the chroot. In other words, the user's remote working directory will appear as /home/<user>.

You can optionally bind mount directories under /home/<user>/sftp/home/<user>, or anywhere under /home/<user>/sftp (which is / from the user's point of view).

It's possible to omit the sftp/ directory, create /home/<user>/home/<user> and chroot into /home/<user>, but this can be confusing as the .ssh directory and any other files will show up for the user in their /. The sftp/ directory keeps things clean.

Note: In practice, if a user's home directory is missing, sftp will normally just cd into /. You could abuse this property by not creating /home/<user> inside the chroot, so the user starts in / instead of /home/<user>. This is a bit fragile, but could come in handy.

Answer 3

I attempted this solution (putting AuthorizedKeysFile into the Match block) and sshd -T complains:

/etc/ssh/sshd_config line 153: Directive 'AuthorizedKeysFile' is not allowed within a Match block

(RHEL 6.6, openssh 5.3p1-104)

SOLUTION: The authorized_keys file (and the user's .ssh directory) must exist in the home directory location defined by /etc/passwd, outside of the chroot directory.

For example (using the OP usernames/uids):
/etc/passwd:

backup:x:1002:1003::/home/backup:/sbin/nologin

Create directory /home/backup, owned by root
Create directory /home/backup/.ssh, change ownership to backup, chmod 700 /home/backup/.ssh
Copy the authorized_keys file to /home/backup/.ssh, chmod 400 authorized_keys

ls -laR /home

/home:
total 12
drwxr-xr-x 3 root     root      4096 Jul  9 12:25 .
drwxr-xr-x 3 root     root      4096 Sep 22 2014  ..
drwxr-xr-x 3 root     root      4096 Jul  9 12:25 backup

/home/backup:
total 12
drwxr-xr-x 3 root     root      4096 Jul  9 12:25 .
drwxr-xr-x 3 root     root      4096 Jul  9 12:25 ..
drwx------ 3 backup   sftpusers 4096 Jul  9 12:28 .ssh

/home/backup/.ssh:
total 12
drwx------ 3 backup   sftpusers 4096 Jul  9 12:28 .
drwxr-xr-x 3 root     root      4096 Jul  9 12:25 ..
-r-------- 3 backup   sftpusers 391  Jul  9 12:29 authorized_keys 

/etc/ssh/sshd_config becomes:

Match Group sftpusers
  ChrootDirectory /sftp/%u
  ForceCommand internal-sftp
  AllowTcpForwarding no
  X11Forwarding no

The chroot directory structure is then:

ls -laR /sftp/
/sftp/:
total 12
drwxr-xr-x  3 root root 4096 May  3 16:55 .
drwxr-xr-x 23 root root 4096 May  3 14:46 ..
drwxr-xr-x  3 root root 4096 May  3 16:45 backup

/sftp/backup:
total 12
drwxr-xr-x 3 root     root      4096 May  3 16:45 .
drwxr-xr-x 3 root     root      4096 May  3 16:55 ..
drwxr-xr-x 3 backup   sftpusers 4096 May  3 16:55 incoming
drwxr-xr-x 3 root     root      4096 May  3 16:55 home

/sftp/backup/incoming:
total 12
drwxr-xr-x 3 backup sftpusers 4096 May  3 16:55 .
drwxr-xr-x 3 root     root      4096 May  3 16:45 ..

/sftp/backup/home:
total 12
drwxr-xr-x 3 root     root      4096 May  3 16:55 .
drwxr-xr-x 3 root     root      4096 May  3 16:45 ..
drwx------ 2 backup   sftpusers 4096 May  3 21:06 backup

/sftp/backup/home/backup:
total 12
drwx------ 3 backup   sftpusers 4096 May  3 21:06 .
drwxr-xr-x 3 root     root      4096 May  3 16:55 ..

Note: /sftp/backup/home/backup is empty, it's only there to provide a path that will look like the non-chroot /home/backup -- the .ssh directory is /home/backup/.ssh not /sftp/backup/home/backup/.ssh

Answer 4

Problem resolved.

I have changed it: AuthorizedKeysFile /sftp/backup/incoming/.ssh/authorized_keys to: AuthorizedKeysFile /sftp/%u/.ssh/authorized_keys