Arch Linux

climbTheStairs

Member

From: North America

Registered: 2021-09-22

Posts: 12

Enabling password authentication with chrooted SFTP server

I followed the steps on ArchWiki (with some modifications) for setting up chrooting on my SFTP server.

In the "Configure OpenSSH" section, the article recommends setting

PasswordAuthentication no

inside

Match Group sftponly

However, I wish to enable logging in via password, so I instead set it to

PasswordAuthentication yes

However, when attempting to login with a password, I receive the error:

Permission denied, please try again.

I found that changing the login shell of the SFTP user from `/usr/bin/nologin` (which is in the instructions on the wiki page) to `/bin/bash` allowed me to login with a password.

However, why does authentication via SSH keys work when the login shell is set to `/usr/bin/nologin` but not password authentication?  After all, no shell but only SFTP is used after logging in.

Also, are there any risks of letting people log in to a user where `--shell` is set to `/bin/bash`, even with SFTP configurations?  The article surely has a reason for using that setting.

I'm using OpenSSH 8.7p1-2.

ponyrider

Member

Registered: 2014-11-18

Posts: 112

Re: Enabling password authentication with chrooted SFTP server

for password authentication

UsePam yes

and think you also need to activate the sftp subsystem

Subsystem	sftp	/usr/lib/ssh/sftp-server

climbTheStairs

Member

From: North America

Registered: 2021-09-22

Posts: 12

Re: Enabling password authentication with chrooted SFTP server

Thanks for the reply!

I already have `UsePam yes` in my global settings.  Do I need to specify that again inside `Match Group sftponly`?

I also already have the SFTP subsystem activated; my problem is not that I am unable to log in to my server (I am able to do that with keys), but that I am unable to log in using password authentication.