User migration from FTP to Jailed SFTP without data loss AT INNODATA

Challenge: User migration from FTP to Jailed SFTP without data loss

Client: Innodata-Isogen

OS: RedHat Enterprise Linux 5.5 i386

Step 1:

Install the OpensSSH latest version and that must support the chroot() function.

openssh-5.8p2-16.el5.1

Step 2:

Configure OpenSSH to use its internal sftp subsystem by editing the sshd_config file:

# vim /etc/ssh/sshd_config

Replace

Subsystem sftp /usr/local/libexec/sftp-server
by
Subsystem sftp internal-sftp

Step 3:

Now configure the chroot() by using match rule, add the below entries in the end of the sshd_config file:

# vim /etc/ssh/sshd_config

-----------------------------------------------------

Match group sftponly
ChrootDirectory /home/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

-----------------------------------------------------

Note: Here %u represents username, that means all the users in the sftponly group home directories are chrooted. Also chroot directory must be owned by root.

Step 4:

Add one new group named as sftponly:

# groupadd sftponly

Step 5:

Create a new user to use restricted sftp:

# useradd -g sftponly test
# passwd test
# usermod -s /bin/false test
# chmod 755 /home/test
# mkdir /home/test/ftpdata
# chown root.root /home/test
# chown test.sftponly /home/test/ftpdata

Step 6:

Now test the configuration from client side or Windows Client "WinSCP" or "Filezilla":

$ sftp test@SFTP-SERVER

Step 7:

Now start user migration from VSFTP to SFTP.

First stop the vsftpd service:

# /etc/init.d/vsftpd stop

Step 8:

Before start migration steps, must take backup of "/etc/passwd" file.

Step 9:

Now Create all FTP user's list and save as "userlist.txt".

Step 10:

Now create script to migarte all FTP user accounts without data loss and execute it:

-----------------------------------------------------------------
#!/bin/bash
echo "All SFTP User Migration Start ...............";
users=`/bin/cat userlist.txt`;
for i in $users
do
echo "Migrating FTP user '$i' into SFTP account:";
/usr/sbin/usermod -g sftponly $i;
/usr/sbin/usermod -s /bin/false $i;
/bin/chmod 755 /home/$i;
/bin/mkdir /home/DATA/ftpdata;
/bin/mv /home/$i/* /home/DATA/ftpdata/;
/bin/mv /home/DATA/ftpdata /home/$i/;
/bin/chown root.root /home/$i;
/bin/chown $i.sftponly /home/$i/ftpdata;
echo "User '$i' Successfully Migrate."
echo " ";
done
echo "User Migration Completed.";
-----------------------------------------------------------------

Note:

Before using this script, you must check all lines on script.

Step 11:

Now restart SSH service:

# /etc/init.d/sshd restart

Step 13:

Finally check SFTP jailed environment and all user's data on "/home/USERNAME/ftpdata" directory.

Created and Implemented by: Heera Singh Koranga