TetraWiki - User contributions [en]

User migration from FTP to Jailed SFTP without data loss AT INNODATA

2013-01-01T11:57:30Z

Heera: /* Challenge: User migration from FTP to Jailed SFTP without data loss */

[[category:INNODATA]]

==Challenge: User migration from FTP to Jailed SFTP without data loss==

'''Client:''' Innodata-Isogen

'''OS:''' RedHat Enterprise Linux 5.5 i386

'''Step 1:'''

Install the OpensSSH latest version and that must support the chroot() function.

openssh-5.8p2-16.el5.1

'''Step 2:'''

Configure OpenSSH to use its internal sftp subsystem by editing the sshd_config file:

<nowiki># vim /etc/ssh/sshd_config</nowiki>

Replace

Subsystem sftp /usr/local/libexec/sftp-server
by
Subsystem sftp internal-sftp

'''Step 3:'''

Now configure the chroot() by using match rule, add the below entries in the end of the sshd_config file:

<nowiki># vim /etc/ssh/sshd_config</nowiki>

<nowiki>-----------------------------------------------------</nowiki>

Match group sftponly
ChrootDirectory /home/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

<nowiki>-----------------------------------------------------</nowiki>

'''Note:'''
Here %u represents username, that means all the users in the sftponly group home directories are chrooted. Also chroot directory must be owned by root.

'''Step 4:'''

Add one new group named as sftponly:

<nowiki># groupadd sftponly</nowiki>

'''Step 5:'''

Create a new user to use restricted sftp:

<nowiki># useradd -g sftponly test</nowiki>
<nowiki># passwd test</nowiki>
<nowiki># usermod -s /bin/false test</nowiki>
<nowiki># chmod 755 /home/test</nowiki>
<nowiki># mkdir /home/test/ftpdata</nowiki>
<nowiki># chown root.root /home/test</nowiki>
<nowiki># chown test.sftponly /home/test/ftpdata</nowiki>

'''Step 6:'''

Now test the configuration from client side or Windows Client "WinSCP" or "Filezilla":

$ sftp test@SFTP-SERVER

'''Step 7:'''

Now start user migration from VSFTP to SFTP.

First stop the vsftpd service:

<nowiki># /etc/init.d/vsftpd stop</nowiki>

'''Step 8:'''

Before start migration steps, must take backup of "/etc/passwd" file.

'''Step 9:'''

Now Create all FTP user's list and save as "userlist.txt".

'''Step 10:'''

Now create script to migarte all FTP user accounts without data loss and execute it:

<nowiki>-----------------------------------------------------------------</nowiki>
<nowiki>#!/bin/bash</nowiki>
echo "All SFTP User Migration Start ...............";
users=`/bin/cat userlist.txt`;
for i in $users
do
echo "Migrating FTP user '$i' into SFTP account:";
/usr/sbin/usermod -g sftponly $i;
/usr/sbin/usermod -s /bin/false $i;
/bin/chmod 755 /home/$i;
/bin/mkdir /home/DATA/ftpdata;
/bin/mv /home/$i/* /home/DATA/ftpdata/;
/bin/mv /home/DATA/ftpdata /home/$i/;
/bin/chown root.root /home/$i;
/bin/chown $i.sftponly /home/$i/ftpdata;
echo "User '$i' Successfully Migrate."
echo " ";
done
echo "User Migration Completed.";
<nowiki>-----------------------------------------------------------------</nowiki>

'''Note:'''

Before using this script, you must check all lines on script.

'''Step 11:'''

Now restart SSH service:

<nowiki># /etc/init.d/sshd restart</nowiki>

'''Step 13:'''

Finally check SFTP jailed environment and all user's data on "/home/USERNAME/ftpdata" directory.

Created and Implemented by: Heera Singh Koranga

User migration from FTP to Jailed SFTP without data loss AT INNODATA

2013-01-01T11:54:42Z

Heera: /* Challenge: User migration from FTP to Jailed SFTP without data loss */

[[category:INNODATA]]

==Challenge: User migration from FTP to Jailed SFTP without data loss==

'''Client:''' Innodata-Isogen

'''OS:''' RedHat Enterprise Linux 5.5 i386

'''Step 1:'''

Install the OpensSSH latest version and that must support the chroot() function.

openssh-5.8p2-16.el5.1

'''Step 2:'''

Configure OpenSSH to use its internal sftp subsystem by editing the sshd_config file:

<nowiki># vim /etc/ssh/sshd_config</nowiki>

Replace

Subsystem sftp /usr/local/libexec/sftp-server
by
Subsystem sftp internal-sftp

'''Step 3:'''

Now configure the chroot() by using match rule, add the below entries in the end of the sshd_config file:

<nowiki># vim /etc/ssh/sshd_config</nowiki>

<nowiki>-----------------------------------------------------</nowiki>

Match group sftponly
ChrootDirectory /home/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

<nowiki>-----------------------------------------------------</nowiki>

'''Note:'''

Here %u represents username, that means all the users in the sftponly group home directories are chrooted. Also chroot directory must be owned by root.

'''Step 4:'''

Add one new group named as sftponly:

<nowiki># groupadd sftponly</nowiki>

'''Step 5:'''

Create a new user to use restricted sftp:

<nowiki># useradd -g sftponly test</nowiki>
<nowiki># passwd test</nowiki>
<nowiki># usermod -s /bin/false test</nowiki>
<nowiki># chmod 755 /home/test</nowiki>
<nowiki># mkdir /home/test/ftpdata</nowiki>
<nowiki># chown root.root /home/test</nowiki>
<nowiki># chown test.sftponly /home/test/ftpdata</nowiki>

'''Step 6:'''

Now test the configuration from client side or Windows Client "WinSCP" or "Filezilla":

$ sftp test@SFTP-SERVER

'''Step 7:'''

Now start user migration from VSFTP to SFTP.

First stop the vsftpd service:

<nowiki># /etc/init.d/vsftpd stop</nowiki>

'''Step 8:'''

Before start migration steps, must take backup of "/etc/passwd" file.

'''Step 9:'''

Now Create all FTP user's list and save as "userlist.txt".

'''Step 10:'''

Now create script to migarte all FTP user accounts without data loss and execute it:

<nowiki>-----------------------------------------------------------------</nowiki>
<nowiki>#!/bin/bash</nowiki>
echo "All SFTP User Migration Start ...............";
users=`/bin/cat userlist.txt`;
for i in $users
do
echo "Migrating FTP user '$i' into SFTP account:";
/usr/sbin/usermod -g sftponly $i;
/usr/sbin/usermod -s /bin/false $i;
/bin/chmod 755 /home/$i;
/bin/mkdir /home/DATA/ftpdata;
/bin/mv /home/$i/* /home/DATA/ftpdata/;
/bin/mv /home/DATA/ftpdata /home/$i/;
/bin/chown root.root /home/$i;
/bin/chown $i.sftponly /home/$i/ftpdata;
echo "User '$i' Successfully Migrate."
echo " ";
done
echo "User Migration Completed.";
<nowiki>-----------------------------------------------------------------</nowiki>

'''Note:'''

Before using this script, you must check all lines on script.

'''Step 11:'''

Now restart SSH service:

<nowiki># /etc/init.d/sshd restart</nowiki>

'''Step 13:'''

Finally check SFTP jailed environment and all user's data on "/home/USERNAME/ftpdata" directory.

Created and Implemented by: Heera Singh Koranga

DOCUMENT OF SFTP SERVER WITH 256 BIT AES ENCRYPTION

2013-01-01T11:08:55Z

Heera:

[[category:INNODATA]]

==DOCUMENT OF SFTP SERVER WITH 256 BIT AES ENCRYPTION AT INNODATA ==

Sftp comes with ssh service so there is no separate daemon for this

[[Image:SFTP2.png]]

'''STEPS'''. Open sshd config file which is /etc/ssh/sshd_config

Comment out below line

<nowiki>#Subsystem </nowiki>sftp /usr/libexec/openssh/sftp-server

And add below lines
Subsystem sftp internal-sftp
Match Group sftponly
ChrootDirectory /home/%u <nowiki>#JAILED FTP</nowiki>
ForceCommand internal-sftp
AllowTcpForwarding no
Ciphers aes256-ctr,aes256-cbc <nowiki>#to enable aes 256bit encryption</nowiki>

'''Commands to Add New User'''. Type in terminal:

# groupadd sftponly
# usermod -g sftponly saket
# usermod -s /bin/false saket
# chmod 755 /home/saket
# chmod 755 /home/saket
# chown root:root /home/saket
# mkdir /home/saket/FTPDATA
# chown saket:sftponly /home/saket/FTPDATA

'''Now Restart SSH Service'''.
# /etc/init.d/ssh restart