Setting up an SFTP Account with RSA Key Access

Sometimes you need to setup an SFTP account with a user name and password... Other times you're asked to provide a RSA key for authentication. I'll be going over the setup of an account using RSA authentication. For this setup, I have a CentOS Linux box sitting in the DMZ that has been hooked into Active Directory (AD) using Centrify (more about Centrify HERE). I have Centrify scoped to only allow logins to users in two groups within AD, "Domain Admins" and "SFTP-Only-Users". The configuration/setup of Centrify is beyond the scope of this, but any documentation for setting up group based access can be found by searching through their KB articles. I also use Centrify enabled Samba to share the folders to the internal systems. This makes it easy to setup a task to move files from the SFTP directories to an internal file server, or to grant access to your internal users.

Setting up the user account 

With that said, the user account is created in AD, and assigned to the appropriate groups. The SFTP Users group for access, and a specific group for access to the folders we'll create in a moment. The purpose of assigning a group to the IN and OUT folders so you could set up a task to have the file moved to an internal file server, or provide your users access to the folders from an internal system.

Setting up the SFTP Directories

So, we'll make a total of three directories, the home directory, an IN and an OUT. From there, we'll set the permissions so that the SFTP user is chrooted to the IN and OUT directory.

As root, issue the following (replace 'UserName' and 'GroupName' with the AD user and group needed for access):

mkdir -p /home/[UserName]/{IN,OUT}
chown [UserName].[GroupName] /home/[UserName]/{IN,OUT]
chmod 2755 /home/[UserName]
chmod 770 /home/[UserName]/{input,output}

Setting up Samba

Now, whether you're a nut like me and use Centrify enabled Samba or the normal Samba, this should be a similar process. You'll be editing the 'smb.conf' file to add the necessary information to share the IN and OUT directories created above.

sudo vi /etc/samba/smb.conf

Add the following to the end of the config file:

[ShareName-IN]
path = /home/[UserName]/IN
public = no
valid usrs = +DOMAIN\[GroupName]
write list = +DOMAIN\[GroupName]
writeable = yes
create mask = 770
directory mask - 2770

Do the same for the OUT directory, but replace IN with OUT (obviously...I hope...). Save the file and restart the service.

sudo service centrifydc-samba restart

Creating RSA Keys for Access

Finally, we're to the point where we need to creat the RSA keys for authentication. At this moment, we will need to change the ownership of the /home/[UserName] directory to the user account in order to create the '.ssh' directory and keys. Then we will extract the public key and you'll share that with whomever needs access. Be cautious about who you share that file with, because it will allow access to your SFTP server.

As root, complete the following:

chown [UserName].[GroupName] /home/[UserName]
su [UserName]
cd /home/[UserName]
mkdir .ssh
cd .ssh
ssh-keygen -t rsals
cat id_rsa.pub >> authorized_keys
cd ..
chmod 700 .ssh
chmod 7000 .ssh/authorized_keys
chmod 700 .ssh/id_rsa
exit
chown root.root /home/[UserName]

Finally, you'll need to export the 'id_rsa.pub' file, rename it to what you want to identify it as, then send it off to the parties that need access to the SFTP account. All that *should* do it. Good luck.