When an SFTP user logs in, they are taken to the root directory of the Linux filesystem.
The root cause is a Group ID conflict (999) between SFTP Gateway and another service installed on your Azure VM. Membership to the
sftponly group is how we chroot SFTP users.
The solution is to change the GID of
sftponly to some other number (899).
Verify the Group ID
SFTP users are chrooted if they are members of the
sftponly group. The first thing to check is whether they are members of this group. SSH into the VM and run this command:
sudo getent group
On a working system, you should see the following:
- Your SFTP users should appear next to the
sftponlygroup should be the only one with GID 999
If you are seeing another group using GID 999, you will need to change the GID for
Change the Group ID
Since we are using LDAP, you will have to change the GID for
sftponly at the LDAP level.
- Create a file named `updategroupnumber.ldif` with the following contents:
dn: cn=sftponly,ou=Groups,dc=sftpgateway,dc=com changetype: modify replace: gidNumber gidNumber: 899
This file contains instructions to change the
sftponlygroup within LDAP.
- Get the LDAP password. You'll use this later to modify LDAP. (The following code should be a single line)
ldappassword=$(sudo grep ldap.password /opt/sftpgw/application.properties | cut -d`=` -f2)
This copies the LDAP password from the
application.propertiesfile, and stores it in the variable
- Run the modify command:
ldapmodify -D cn=admin -w $ldappassword -f updategroupnumber.ldif
This command modifies LDAP. Specifically, it changes the
sftponlyto 899. And it uses the admin/ldappassword credentials you copied earlier.