Linux创建sftp用户

古城微笑少年丶 2022-05-24 00:54 209阅读 0赞

最近做的一个需求涉及到使用sftp模式传输文件，所以本地虚拟机创建了一个sftp用户供文件上传测试，这里记录下虚拟机上搭建sftp服务的过程。

1、创建连接服务器的sftp用户

useradd -d/home/sftp1 -s /sbin/nologin testsftp

/home/sftp1：sftp用户所在的目录，如果该目录已存在会报错

testsftp：创建的sftp用户名

![20180517125752625][]

2、修改创建的sftp用户的登录密码

passwd testsftp

![20180517125810602][]

3、修改sshd\_config配置文件

vim/etc/ssh/sshd_config

添加如下代码：

Subsystem       sftp  internal-sftp
    
    Match Usertestsftp

![20180517131848153][]

注意需要将原来的

Subsystem      sftp    /usr/libexec/openssh/sftp-server

注释掉，否则重启sshd服务会报错：

![20180517131942862][]

4、修改sftp目录权限

可以根据需要修改sftp用户目录为可读可写可执行权限

chmod 777/home/sftp1

5、修改好配置后重启sftp服务：

service sshd restart

查看sftp服务启动状态：

service sshd status

![20180517132044189][]

说明启动成功。

6、使用sftp连接服务器

可以在终端中直接使用sftp username@ip命令登录

![20180517132105886][]

也可以使用终端连接工具比如xshell连接

![20180517132132615][]

![20180517132150648][]

7、对于可能出现的一些问题大多是由于sshd\_config配置的问题造成的，这里贴出我的机器上的配置，经测试可以成功，如果有特殊需求配置可以参考网络上其他人的介绍。

#       $OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $
    
    # This is the sshd server system-wide configuration file.  See
    # sshd_config(5) for more information.
    
    # This sshd was compiled with PATH=/usr/local/bin:/usr/bin
    
    # The strategy used for options in the default sshd_config shipped with
    # OpenSSH is to specify options with their default value where
    # possible, but leave them commented.  Uncommented options override the
    # default value.
    
    # If you want to change the port on a SELinux system, you have to tell
    # SELinux about this change.
    # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
    #
    #Port 22
    #AddressFamily any
    #ListenAddress 0.0.0.0
    #ListenAddress ::
    
    # The default requires explicit activation of protocol 1
    #Protocol 22
    
    # HostKey for protocol version 1
    #HostKey /etc/ssh/ssh_host_key
    # HostKeys for protocol version 2
    HostKey /etc/ssh/ssh_host_rsa_key
    #HostKey /etc/ssh/ssh_host_dsa_key
    HostKey /etc/ssh/ssh_host_ecdsa_key
    HostKey /etc/ssh/ssh_host_ed25519_key
    
    # Lifetime and size of ephemeral version 1 server key
    #KeyRegenerationInterval 1h
    #ServerKeyBits 1024
    
    # Ciphers and keying
    #RekeyLimit default none
    
    # Logging
    # obsoletes QuietMode and FascistLogging
    #SyslogFacility AUTH
    SyslogFacility AUTHPRIV
    #LogLevel INFO
    
    # Authentication:
    
    #LoginGraceTime 2m
    #PermitRootLogin yes
    #StrictModes yes
    #MaxAuthTries 6
    #MaxSessions 10
    
    #RSAAuthentication yes
    #PubkeyAuthentication yes
    
    # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
    # but this is overridden so installations will only check .ssh/authorized_keys
    AuthorizedKeysFile      .ssh/authorized_keys
    
    #AuthorizedPrincipalsFile none
    
    #AuthorizedKeysCommand none
    #AuthorizedKeysCommandUser nobody
    
    # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
    #RhostsRSAAuthentication no
    # similar for protocol version 2
    #HostbasedAuthentication no
    # Change to yes if you don't trust ~/.ssh/known_hosts for
    # RhostsRSAAuthentication and HostbasedAuthentication
    #IgnoreUserKnownHosts no
    # Don't read the user's ~/.rhosts and ~/.shosts files
    #IgnoreRhosts yes
    
    # To disable tunneled clear text passwords, change to no here!
    #PasswordAuthentication yes
    #PermitEmptyPasswords no
    PasswordAuthentication yes
    
    # Change to no to disable s/key passwords
    #ChallengeResponseAuthentication yes
    ChallengeResponseAuthentication no
    
    # Kerberos options
    #KerberosAuthentication no
    #KerberosOrLocalPasswd yes
    #KerberosTicketCleanup yes
    #KerberosGetAFSToken no
    #KerberosUseKuserok yes
    
    # GSSAPI options
    GSSAPIAuthentication yes
    GSSAPICleanupCredentials no
    #GSSAPIStrictAcceptorCheck yes
    #GSSAPIKeyExchange no
    #GSSAPIEnablek5users no
    
    # Set this to 'yes' to enable PAM authentication, account processing,
    # and session processing. If this is enabled, PAM authentication will
    # be allowed through the ChallengeResponseAuthentication and
    # PasswordAuthentication.  Depending on your PAM configuration,
    # PAM authentication via ChallengeResponseAuthentication may bypass
    # the setting of "PermitRootLogin without-password".
    # If you just want the PAM account and session checks to run without
    # PAM authentication, then enable this but set PasswordAuthentication
    # and ChallengeResponseAuthentication to 'no'.
    # WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
    # problems.
    UsePAM yes
    
    #AllowAgentForwarding yes
    #AllowTcpForwarding yes
    #GatewayPorts no
    X11Forwarding yes
    #X11DisplayOffset 10
    #X11UseLocalhost yes
    #PermitTTY yes
    #PrintMotd yes
    #PrintLastLog yes
    #TCPKeepAlive yes
    #UseLogin no
    UsePrivilegeSeparation sandbox          # Default for new installations.
    #PermitUserEnvironment no
    #Compression delayed
    #ClientAliveInterval 0
    #ClientAliveCountMax 3
    #ShowPatchLevel no
    #UseDNS yes
    #PidFile /var/run/sshd.pid
    #MaxStartups 10:30:100
    #PermitTunnel no
    #ChrootDirectory none
    #VersionAddendum none
    
    # no default banner path
    #Banner none
    
    # Accept locale-related environment variables
    AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
    AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
    AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
    AcceptEnv XMODIFIERS
    
    # override default of no subsystems
    #Subsystem      sftp    /usr/libexec/openssh/sftp-server
    
    #Subsystem       sftp   internal-sftp
    #Match User testsftp
    
    Subsystem       sftp   internal-sftp
    Match User sftpuser
    # Example of overriding settings on a per-user basis
    #Match User anoncvs
    #       X11Forwarding no
    #       AllowTcpForwarding no
    #       PermitTTY no
    #       ForceCommand cvs server

[20180517125752625]: /images/20220524/fe1ff8be8e7a4154a500bbf12a7e03b8.png
[20180517125810602]: /images/20220524/22bbd9a8c0b04b90877260ffe1e1d272.png
[20180517131848153]: /images/20220524/4f33bfe84aed4632af16ec5c894ef334.png
[20180517131942862]: /images/20220524/e035880773504afbae7ff36f2c2ded40.png
[20180517132044189]: /images/20220524/c1fd9006973547878cac648d086cbf00.png
[20180517132105886]: /images/20220524/583abe7ba6524dc9b7f0909378ac635c.png
[20180517132132615]: /images/20220524/d5f84bafb69247f7b6f1e8261bc90201.png
[20180517132150648]: /images/20220524/11dbee7ab06e4b098ff6f6e4a5ace3c5.png