sftp是sshd服务默认集成的子服务,不需要单独的安装包,只需要进行一些配置即可
useradd sftpuser
passwd sftpuser / Transfar2026
vi /etc/ssh/sshd_config && systemctl restart sshd
把下面段粘贴到文件的最后一行,不然重启sshd服务的时候会出错
Match User sftpuser
X11Forwarding no
AllowTcpForwarding no
ChrootDirectory /home/sftpuser
PasswordAuthentication yes
ForceCommand internal-sftp
chown -R root:root /home/sftpuser
chmod 755 /home/sftpuser
mkdir /home/sftpuser/upload
chown sftpuser:sftpuser /home/sftpuser/upload
chmod 755 /home/sftpuser/upload
sftp -v sftpuser@192.168.30.229
journalctl -u sshd -f
tail -f /var/log/secure
sftp配置成功
HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ecdsa_key_384 SyslogFacility AUTH PermitRootLogin yes MaxAuthTries 5 AuthorizedKeysFile .ssh/authorized_keys PasswordAuthentication yes ChallengeResponseAuthentication no GSSAPIAuthentication yes GSSAPICleanupCredentials no UsePAM yes X11Forwarding no PrintMotd no AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS Subsystem sftp /usr/libexec/openssh/sftp-server -l INFO -f AUTH Protocol 2 LogLevel VERBOSE PubkeyAuthentication yes IgnoreRhosts yes HostbasedAuthentication no PermitEmptyPasswords no PermitUserEnvironment no ClientAliveCountMax 0 Banner /etc/issue.net StrictModes yes AllowTcpForwarding no AllowAgentForwarding no GatewayPorts no PermitTunnel no PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1 Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1 HostbasedAcceptedKeytypes ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512 GSSAPIKexAlgorithms gss-group14-sha256-,gss-group16-sha512-,gss-curve25519-sha256- CASignatureAlgorithms ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256 HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512 PubkeyAcceptedKeyTypes ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512 Match User sftpusers ChrootDirectory /app/sftpuser AllowTcpForwarding no X11Forwarding no PasswordAuthentication yes ForceCommand interal-sftp
严格算法sshd_config
HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key SyslogFacility AUTH PermitRootLogin no AuthorizedKeysFile .ssh/authorized_keys PasswordAuthentication yes ChallengeResponseAuthentication no GSSAPIAuthentication yes GSSAPICleanupCredentials no UsePAM yes X11Forwarding no PrintMotd no AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS Subsystem sftp /usr/libexec/openssh/sftp-server -l INFO -f AUTH Protocol 2 LogLevel VERBOSE PubkeyAuthentication yes RSAAuthentication yes IgnoreRhosts yes RhostsRSAAuthentication no HostbasedAuthentication no PermitEmptyPasswords no PermitUserEnvironment no Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com ClientAliveCountMax 0 Banner /etc/issue.net MACs hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha1,hmac-sha1-96 StrictModes yes AllowTcpForwarding no AllowAgentForwarding no GatewayPorts no PermitTunnel no KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256 Match User sftpuser X11Forwarding no AllowTcpForwarding no ChrootDirectory /home/sftpuser PasswordAuthentication yes ForceCommand internal-sftp
正常配置sshd_config
因为sshd_config配置算法严格,导致命令行测试sftp上传文件正常,通过程序客户端上传文件即报错。用正常sshd_config覆盖严格算法sshd_config 重启sshd 即可
把sshd_config配置文件中的HostbasedAcceptedKeytypes等相关配置先去掉即可
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。