Steps to create a new SSH user and SFTP user

ADD_SFTP_User.md

How to add a SFTP user to your VM managed by ServerPilot control panel using Ubuntu 14.04

I am not a security expert, so take it for what its worth.

OpenSSH has this ability built in, few people just seem to use the feature. Below is what works for me, but if you have a better way please share the uninformed.

The Steps:

1. First create a new app inside of the SP control panel
2. Now, decide what direcoty you want to put the users directory; either <app_name> or <app_name>/public. This will keep trolls at bay.
   • NOTE: The entire path MUST be owned by root.
3. Update your directory PATH to root:

sudo chown root:root /srv
sudo chown root:root /srv/users
sudo chown root:root /srv/users/serverpilot
sudo chown root:root /srv/users/serverpilot/apps
sudo chown root:root /srv/users/serverpilot/apps/<app_anme>

• 4. Create the new user account:

sudo adduser --home /srv/users/serverpilot/apps/<app_name> <new_sftp_user>

Follow the prompt and note that this will create a user and group with the name you supplied.

• 5. Create a new group that has only SFTP access (no SSH access)

sudo groupadd <new_sftp_group>

• 6. Add the new user to the new group and change ownership of their home directory to root

sudo usermod -a -G <new_sftp_user> <new_sftp_user>
sudo usermod -a -G <new_sftp_group> <new_sftp_user>
sudo chown root:root /srv/users/serverpilot/apps/<app_name>

Now that the user is all setup and has the correct permission, we need to configure OpenSSH.

• 7. Configure the internal sftp server, by editing the sshd_config file

sudo vim /etc/ssh/sshd_config

If you don't use vim the replace with whatever editor - ie: nano

• 8. Search for Subsystem (I like to duplicate the line and comment out the original)

  • Add the following:

    # Subsystem sftp /usr/lib/openssh/sftp-server
    Subsystem sftp internal-sftp

• 9. Set up the chroot environment - (You should still have the file open)

  • add to the very BOTTOM of the sshd_config

  Match Group <new_sftp_group>
      ChrootDirectory %h
      X11Forwarding no
      AllowTcpForwarding no
      ForceCommand internal-sftp

  • It's important that Match Group <new_sftp_group> is the same group you created earlier.

• 10. Save and restart the ssh server

  # restart SSH
  sudo service ssh restart 

That's all there is to it.

So if you want to test. You'll need to use an FTP client that supports SFTP.

I should mention that you'll need to do Steps 1 - 6 each time you add another SFTP user.

ADD_SSH_User.md

How to add an SSH user to your VM manged by ServerPilot control panel using Ubuntu 14.04

But in theory will work for VMs in general ie: DigitalOcean or AWS instance

Also NOTE: I am not a security expert, so take it for what its worth.

There seems to be some confusion regarding what gist does regarding permissions - Which you can see in the comments, and I can understannd why some are confused based on the nature of it all. So Here is a tutorial on adding a new SSH user to your VM. Note that any new user using this method will have all the same permissions that the serverpilot user does, so don't go crazy adding users. Add the ones you trust.

---

So a good example of a use case would be - you have a VM that has a few projects on it. There is a new developer on your team -- then follow the steps below.

---

The Steps:

1. Add new user (you might need to use sudo)

   useradd <new_user> 

2. Follow on screen prompts - this will allow SSH with the password set from the prompts (If there are no prompts just move on to Step 3 You will reset the password in the last step

3. Update user's home directory to ServerPilots apps direcotry OR vim /etc/passwd to change the new users path - This will be the directory where they will arrive when connecting with SSH

   usermod -d /srv/users/serverpilot/apps <new_user>  

4. Add the user to the ServerPilot Group

   usermod -a -G serverpilot <new_user>

5. Check permissions of the apps directory

   ls -ld /srv/users/serverpilot/apps/ 

The output should look like drwxr-xr-x 2 root serverpilot 4096 Jan 27 09:08 /srv/users/serverpilot/apps/

6. Add read write execute permission to ServerPilot Group

   chown -vR :serverpilot /srv/users/serverpilot/apps/ 

This changed ownership of /srv/users/serverpilot/apps/ from root:root to :serverpilot

7. Grant write permission to the group owner

   chmod -vR g+w /srv/users/serverpilot/apps/ 

This changed from 0755 (rwxr-xr-x) to 0775 (rwxrwxr-x)

8. Change password of the new user (only if prompt didn't work) You may need sudo

   sudo passwd <new_user>

Some good stuff to know

List all user:

cut -d: -f1 /etc/passwd

Delete a user:

sudo userdel <user_name>

Delet a group:

sudo groupdel <group_name>

The short way:

step 1

useradd -d /srv/users/serverpilot/apps -G serverpilot -M <user_name>

step 2

passwd <user_name>

step 3

chown -vR :serverpilot /srv/users/serverpilot/apps/ | chmod -vR g+w /srv/users/serverpilot/apps/ 

EDIT

The original gist only talked about adding SSH user with pretty much root access and was 100% clone of serverpilot user.
I have updated it showing how to adding SFTP users by jailing them to a single directory you can set yourself

Is this how I can add a user to the system, without paying 10$ a month to serverpilot?

Why do I need a user to access all apps?

The point is having isolation between users / apps

Do you know how to create apps/users in free account?

@tripex - In some ways Yes, but if you need other things like SSL certificates - I'd suggest just paying the 10$/m

@enduardoarandah I made the assumption that most people would know what I'm actually referencing here.
If you want the user to only access a single app or directory you just modify the path
Its not a matter of having a paid or free account with SP but more the less of adding a user to your server... I just use serverpilot a lot.

usermod -d /srv/users/serverpilot/apps/<YOUR APP NAME> <user name>

OR

you can create another group with the same permissions as the serverpilot group and add that group to each APP you want them to access. Same steps apply here.

I did not create, help me? @ginfuru

@pedroyuri1 what do you need help with?

Thanks @ginfuru! that was super helpful.
How do I delete that user in case I decide to void their access in the future?

@ginfuru - I noticed something else. While the command "usermod -d /srv/users/serverpilot/apps/ " lets me specify where the new user goes to when logged in, they still have access to every other app. Is there a way to limit their access to a specific app folder?

@gonebeta to delete a user just do sudo userdel <your_user>

If I don't want a user to have access to the other apps they i just add usermod -d /srv/users/serverpilot/apps/<your_app>/
this limits theme to the app you want them to have access too, if they need to have access to more than one app, you an always add a new Group

I created a user but I want to hide other apps folder from that user. Do you know any way to hide ? thanks @ginfuru

Thanks ginfuru! I'll try that and report back with my findings :)

the user still can browse the folders - usermod -d /srv/users/serverpilot/apps/<your_app>/ wont help.

Also the user would be able to escalate and view and download everything down to the root which normally is not happening with a normal SP system user (except in 14.04 where the SP system user can get into the /etc/nginx-sp/vhost.d if he guess we're using ServerPilot).
Not good :(

Hi there,

I have followed the guide but i ran into a problem.
Changing the owner of /srv/, /srv/users/ and /srv/users/serverpilot/ to root works fine, but when i change the owner of the /srv/users/serverpilot to root all my websites show File not found in the browser. I cannot detect why this is happening. any thoughts?

@nvzsolutions - I am facing the same issue and ended up restoring the droplet. Did you get any resolution on that?

@ginfuru - to use SSL feature for free you could use this script https://github.com/lesaff/serverpilot-letsencrypt

@nvzsolutions, @kwlvarun just change it back to:

sudo chown serverpilot:serverpilot /srv
sudo chown serverpilot:serverpilot /srv/users
sudo chown serverpilot:serverpilot /srv/users/serverpilot
sudo chown serverpilot:serverpilot /srv/users/serverpilot/apps
sudo chown serverpilot:serverpilot /srv/users/serverpilot/apps/<app_anme>