Configure SFTP access to your Ubuntu server through SSH

2015-12-07T15:22:46+00:00

Sometimes you have to give your users a way to manage files on your server. A typical scenario is a web server where your users manage their websites by themselves.

The classical approach in this scenario was to use FTP to give file management capabilities to your users, but it has many drawbacks:

You have to provision and maintain a new service on your server;
FTP is an annoying protocol from a firewall configuration point of view;
FTP is not encrypted by default, and you have to put some effort to configure an FTP server which is protected from sniffing.

If you are a lazy sysadmin like me you’ll prefer to use a service you already have, which is encrypted by default and do not require a special firewall configuration other than the port 22 you are already using.

ssh to the rescue!

Configure ssh server to serve a directory using SFTP, chrooting the user on that directory

Edit the file /etc/ssh/sshd_config by adding the following lines at the bottom:

Match group sftp
ChrootDirectory %h
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

In this way every user belonging to group sftp will be chrooted in his home directory when connecting trough sftp.

If you want to let users access using password, then add this configuration:

PasswordAuthentication yes

Restart ssh server:

sudo service ssh restart

Now add a new group called sftp:

sudo addgroup sftp

And add a system user that will be used to connect:

sudo adduser --home /home/example.com/ --no-create-home --shell /usr/sbin/nologin username

Note how we set the home directory of the user to the root of the website, and how we set the shell to nologin executable, in order to deny access from a regular ssh shell.

Now add the user to sftp group:

sudo adduser username sftp

Set permissions correctly on username home directory and its content. The home directory itself should be owned by root and have 755 permissions, otherwise sftp login will fail:

cd /home/example.com
chown root:sftp .
chmod 755 .
chown -R username:sftp *

Try to connect to your server on port 22 with a client supporting SFTP (such as Filezilla). You should see the content of /home/example.com directory, and you should not be able to go out from that directory.

How to protect your Joomla instance from brute force attacks with Fail2ban

2014-03-31T08:58:04+00:00

If you administer at least one Joomla instance you’ll be subject to brute force attacks before or after. Fail2ban is a very nice service written in Python which periodically scans your log files looking for signs of brute force attacks and perform some actions when an attack is discovered. The most common actions is to ban the attacker IP at firewall level and send an email to the server administrator.

Fail2ban comes bundled with filters for many common services (ssh, apache authentication, etc.), but it lacks a built-in Joomla integration. Anyway it’s easy to add a Joomla filter to Fail2ban, here I explain how to do it.

Table of Contents

Install Fail2ban
Install Fail2ban Joomla plugin
Fail2ban configuration
Be happy when an attacker gets banned

Install Fail2ban

Installing fail2ban in a Debian based server is as simple as issuing the following command:

$ apt-get install fail2ban

Configuring Fail2ban properly is out of scope of this howto, you can find many resources online and in the official Fail2ban wiki.

Install Fail2ban Joomla plugin

To ease the integration of Fail2ban with Joomla authentication system you can install a Joomla fail2ban plugin using the standard Joomla plugin installation mechanism. This plugin logs Joomla authentication errors in the standard web server error log. There it will be easy for Fail2ban to scan for errors and ban the attackers IPs.

After installing and activating the plugin you’ll find something like this in your web server error log when user authentication fails in Joomla:

/var/log/apache2/mywebsite_error.log:[Mon Mar 31 10:13:58 2014] [error] [client 212.109.14.203] user mywebsite authentication failure

Fail2ban configuration

Save this Fail2ban filter in a file called joomla-error.conf and save it in /etc/fail2ban/filters.d:

[Definition]

# Option: failregex
# Notes.: matches something like:
# [Mon Mar 31 10:15:00 2014] [error] [client 212.109.14.203] user mywebsite authentication failure
# Values: TEXT
failregex = [[]client &amp;lt;HOST&amp;gt;[]] user .* authentication failure.*

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Add this jail to your /etc/fail2ban/jail.local:

[joomla-error]
enabled = true
port = http,https
filter = joomla-error
logpath = /var/log/apache2/*error.log
maxretry = 5

Reload fail2ban configuration with:

$ fail2ban-client reload

Be happy when an attacker gets banned

If you configured Fail2ban to send you an email when an attacker is banned you’ll receive an email with a text similar to the following:

The IP 212.109.14.203 has just been banned by Fail2Ban after 5 attempts against joomla-error.

The attacker IP here is left on purpose. I think it’s useful to expose attackers IP in public! 😉

Guguweb - security