Linux与云计算——第二阶段Linux服务器架设
第三章：SSH服务器架设（下）openssh 进阶
5.SFTP+Chroot
配置SFTP only + Chroot.
给一些用户限制他们只允许SFTP访问特定的目录。
[1] 例如, 设置 /home 作为Chroot目录.
# 为SFTP创建一个组
[[email protected] ~]# groupadd sftp_users
# 限制只有用户"user"可以使用SFTP
[[email protected] ~]# usermod -G sftp_users user
[[email protected] ~]# vim /etc/ssh/sshd_config
# line 147: 将该行注释掉并且新增一行，注意区分大小写
#Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp
# 在文件末尾加上下面的内容，注意区分大小写
Match Group sftp_users
AllowTcpForwarding no
ChrootDirectory /home
ForceCommand internal-sftp
[[email protected] ~]# systemctl restart sshd
[2] Try to access with a user and make sure the settings.
[[email protected] ~]$ ssh [email protected]
ssh: connect to host 192.168.96.128 port 22: Connection refused
user用户只允许使用sftp登录访问，所以ssh访问连接被拒绝了
[[email protected] ~]$ sftp [email protected]
Connected to 192.168.96.128.
sftp>
sftp> ls -l
drwx------ 2 1000 1000 59 Jul 8 02:55 jeffrey
drwx------ 3 1001 1001 122 Jul 8 06:25 user
sftp> pwd
Remote working directory: /
sftp> exit
6.SSH端口转发
可以通过SSH端口转发将一个端口的数据转发给另外一个端口.
例如，我们可以将发送到本地8081端口的数据转发给VNC的80端口。这个例子可以描述清楚所有的端口转发案例
[1] 配置一个HTTPD的网页服务并且该服务可以正常使用.
[[email protected] ~]# yum -y install httpd
[[email protected] ~]# systemctl start httpd
[[email protected] ~]# systemctl enable httpd
[[email protected] ~]# firewall-cmd --permanent --add-service=http
[[email protected] ~]# firewall-cmd –reload
[[email protected] ~]# echo "web" >> /var/www/html/index.html
#在本地配置端口转发8081到本地的80端口
[[email protected] ~]$ ssh -L 0.0.0.0:8081:localhost:80 jeffre[email protected]
The authenticity of host ‘localhost (::1)‘ can‘t be established.
ECDSA key fingerprint is 26:a3:c4:bc:cb:36:c5:20:1d:9c:ad:eb:b2:11:bb:36.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘localhost‘ (ECDSA) to the list of known hosts.
[email protected]‘s password:
Last login: Fri Jul 8 17:29:10 2016 from 192.168.96.150 # the password of the working user (it means the login to local to local)
Last login: Thu Jul 10 01:35:15 2014
# confirm
[[email protected] ~]$ elinks http://192.168.96.128：8081
可以看到内容
[[email protected] ~]$ exit
[[email protected] ~]$ elinks http://192.168.96.128:8081
不可以看到内容了
详细视频课程请戳—→ http://edu.51cto.com/course/course_id-6574.html