MySecureShell custom configuration

A simple secure SFTP setup.

New users have disabled bash and similar shells, are allowed to authenticate with password, and are jailed in their home directory.

Configuration

The initial setup to prepare for an easy user management.

SSH

Disable password authentication for all users with an exception for sftp-only group.

Create new groups sftp-admin and sftp-client:

sudo groupadd sftp-admin
sudo groupadd sftp-client

Modify the SSH configuration in /etc/ssh/sshd_config file:

AddressFamily inet
PermitRootLogin no
PasswordAuthentication no
...
Match Group sftp-admin
    PasswordAuthentication yes
Match Group sftp-client
    PasswordAuthentication yes

Restart the process to apply changes:
```
sudo systemctl restart ssh
```

MySecureShell

Setup general connection limitations and default setting for new SFTP users.

Modify the MySecureShell configuration in /etc/ssh/sftp_config file:

<Default>
    GlobalDownload			0
    Download				0
    LimitConnection			100
    LimitConnectionByUser		10
    LimitConnectionByIP			10
    CreateHome				true
    Home				/var/www/$USER
</Default>

<Group sftp-admin>
    Home				/var/www
</Group>

<Group sftp-client>
    Home				/var/www/$USER
</Group>

Restart the process to apply changes:
```
sudo systemctl restart mysecureshell
```

User management

Users bellow have custom SFTP shell and therefore no bash or similar shells.

Create new admin user

Based on previous configuration, this user will have access in all directories.

Note: It is advised to NOT use password authentication for admin users.

Create new user NEW-ADMIN-USER:
```
sudo sftp-user create NEW-ADMIN-USER
```

Add user to sftp-only group:

sudo usermod -a -G sftp-admin NEW-ADMIN-USER

Create new client user

Based on previous configuration, this user will be jailed in /var/www/NEW-CLIENT-USER directory.

Create new user NEW-CLIENT-USER:
```
sudo sftp-user create NEW-CLIENT-USER
```