Azure SFTP User Sees File System Root
When an SFTP user logs in, they are taken to the root directory of the Linux filesystem.
The root cause is a Group ID conflict (999) between SFTP Gateway and another service installed on your Azure VM.
Membership to the
sftponly group is how we chroot SFTP users.
The solution is to change the GID of
sftponly to some other number like 899.
Verify the Group ID
SFTP users are chrooted if they are members of the sftponly group. The first thing to check is whether they are members of this group. SSH into the VM and run this command:
sudo getent group
On a working system, you should see the following:
- Your SFTP users should appear next to the sftponly group
- The sftponly group should be the only one with GID 999
If you are seeing another group using GID 999, you will need to change the GID for
Change the Group ID
Since we are using LDAP, you will have to change the GID for sftponly at the LDAP level.
Create a file named
updategroupnumber.ldifwith the following contents:
dn: cn=sftponly,ou=Groups,dc=sftpgateway,dc=com changetype: modify replace: gidNumber gidNumber: 899
This file contains instructions to change the gidNumber of the
sftponlygroup within LDAP.
Get the LDAP password. You'll use this later to modify LDAP. (The following code should be a single line)
ldappassword=$(sudo grep ldap.password /opt/sftpgw/application.properties | cut -d"=" -f2)
This copies the LDAP password from the application.properties file, and stores it in the variable
Run the modify command:
ldapmodify -D cn=admin -w $ldappassword -f updategroupnumber.ldif
This command modifies LDAP. Specifically, it changes the gidNumber on sftponly to 899. And it uses the admin/ldappassword credentials you copied earlier.