[SOLVED] SFTP-chroot Wiki incorrect? Use /sbin/nologin not /bin/false?

willemw · 2013-02-19 14:07:55

Following the instructions on https://wiki.archlinux.org/index.php/SFTP-chroot, setting the login shell with

# usermod -s /bin/false sftpuser1

does not allow me to sftp into the user account.

Sshd debug output is

debug1: userauth-request for user sftpuser1 service ssh-connection method password [preauth]
debug1: attempt 4 failures 3 [preauth]
debug1: PAM: password authentication failed for sftpuser1: Authentication failure
Failed password for sftpuser1 from <IP> port 42482 ssh2

When replaced with the following two steps, I am able to sftp into the user account

# usermod -s /sbin/nologin sftpuser1

and add the following line to /etc/shells

/sbin/nologin

Should the wiki page be updated or am I missing something?

Last edited by willemw (2013-02-21 12:44:56)

WonderWoofy · 2013-02-19 23:01:25

I followed those same instructions and mine worked fine from the start (and still does). I suspect that whether you realized it or not, there was probably a PEBKAC, and the second time, with /sbin/nologin, you didn't commit this error. But that is just pure speculation.

If it really really concerns you, you should bring this up on the wiki talk page rather than on these forums.

fsckd · 2013-02-20 13:57:25

Moving from Networking, Server, and Protection to Forum & Wiki discussion.

willemw · 2013-02-21 06:42:36

The only difference I can think of is that instead of "usermod -g sftpusers" mentioned on the wiki page, I created a new user account which is only in the sftpusers user group.

seiichiro0185 · 2013-02-21 11:28:26

I had a similar Problem, I had /sbin/nologin for the users, but I didn't put it into /etc/shells. That worked fine until one of the last updates to openssh, the sftp-users couldn't login after that.

I did some investigating and found the cause: the file /etc/pam.d/sshd was changed in one of the last updates, changing the way logins are checked against pam for ssh. In the old file there was no check against /etc/shells, which basically meant you could have anything set as shell for the sftp-users. But with the change in the pam file (its now referencing the base pam files), /etc/shells is now also checked on ssh login, which renders the logins created like discribed on the wiki-page unusable.

So it seems the way the OP used (/sbin/nologin and entry in /etc/shells) is the right one. I have edited the wiki to reflect this change.

willemw · 2013-02-21 12:47:50

Set to solved.

@seiichiro0185: Thanks. I also looked at /etc/pam.d/sshd, however, how did you compare it to a previous version? With A.R.M. or etckeeper?

seiichiro0185 · 2013-02-21 13:24:43

I compared with a backup of the server from before the update

Arch Linux

#1 2013-02-19 14:07:55

[SOLVED] SFTP-chroot Wiki incorrect? Use /sbin/nologin not /bin/false?

#2 2013-02-19 23:01:25

Re: [SOLVED] SFTP-chroot Wiki incorrect? Use /sbin/nologin not /bin/false?

#3 2013-02-20 13:57:25

Re: [SOLVED] SFTP-chroot Wiki incorrect? Use /sbin/nologin not /bin/false?

#4 2013-02-21 06:42:36

Re: [SOLVED] SFTP-chroot Wiki incorrect? Use /sbin/nologin not /bin/false?

#5 2013-02-21 11:28:26

Re: [SOLVED] SFTP-chroot Wiki incorrect? Use /sbin/nologin not /bin/false?

#6 2013-02-21 12:47:50

Re: [SOLVED] SFTP-chroot Wiki incorrect? Use /sbin/nologin not /bin/false?

#7 2013-02-21 13:24:43

Re: [SOLVED] SFTP-chroot Wiki incorrect? Use /sbin/nologin not /bin/false?

Board footer