SSH (OpenSSH)

*******************************************************************************
Instalar, Configurar e Usar o SSH
Criado por: Alessandro C. M. Kuramoto
Data: 14/01/2009
Modificado em: 28/02/2010-15:00
v.20100228-1500
Palavras-chaves: SSH, OpenSSH
keywords: SSH, OpenSSH

If you want to know something about this file, send an e-mail to me at the
sancmk@gmail.com or post a comment here (at the Word Press)

moshi kono fairu no koto wo shiteitakatara, boku ni email wo okutte kudasai,
matawa kono Word Press ni chuushaku mo shitte ii desu.
boku no email wa sancmk@gmail.com desu

Por favor, matenham o nome do autor deste arquivo.
*******************************************************************************

###############################################################################
# Temp:
###############################################################################

Ver sem falta:

http://www.dicas-l.com.br/dicas-l/20060730.php

http://www.gta.ufrj.br/~natalia/SSH/x11.html

Verificar a diretiva:
AllowGroups

|##########^ Temp ############################################################|

###############################################################################
# Ambiente:
###############################################################################

Hardware:

SO: Debian 4.0 (Etch) e 5.0 (Lenny)

===============================================================================
Instalação Básica (modo texto) para o Servidor SFTP:
===============================================================================

SO: Debian 5.0 (Lenny)

RAM            128 MB

Swap           256 MB
/boot           75 MB
/                5 GB
/tmp         1 GB
/home           200 GB

|==========^ Instalação Básica (modo texto) para o Servidor SFTP =============|

—
Hardware SFTP:

RAM: 1 GB

# free -m
total       used       free     shared    buffers     cached
Mem:          1011        987         24          0        116        812
-/+ buffers/cache:         58        953
Swap:          894          0        894

|##########^ Ambiente ########################################################|

###############################################################################
# Conceitos:
###############################################################################

——————————————————————————-
Two SSH configuration options that can be set to improve security should be checked on your production server. UsePrivilegeSeparation is an option, when enabled will allow the OpenSSH server to run a small (necessary) amount of code as root and the of the code in a chroot jail environment. StrictModes checks to ensure that your ssh files and directories have the proper permissions and ownerships before allowing an SSH session to open up. The directives should be set in the /etc/ssh/sshd_config as follows:
UsePrivilegeSeparation yes
StrcitModes yes

(Fonte: http://www.linuxsecurity.com/content/view/124601/2/)

|—————————————————————————–|
|##########^ Ambiente ########################################################|

###############################################################################
# Instalando o OpenSSH:
###############################################################################

===============================================================================
Instalando o OpenSSH no Debian: ( ~10 min <depende da taxa de Download>)
===============================================================================

### Para atualizar a lista de pacotes:
apt-get update

|<<<<< #### Instalando o OpenSSH #### ==== Instalando o OpenSSH no Debian ====
### Instalar o servidor de SSH
apt-get -y install openssh-server

|==========^ Instalando o OpenSSH no Debian ==================================|

===============================================================================
Instalando o OpenSSH no SUSE 10:
===============================================================================

|<<<<<<<<<<<<<< ==== Instalando o OpenSSH no SUSE 10 ====
zypper install openssh

|==========^ Instalando o OpenSSH no SUSE 10 =================================|

|##########^ Instalando o OpenSSH ############################################|

###############################################################################
# Configurando:
###############################################################################
>Configurando

|<<<<<<<<<<<<<< #### Configurando ####
===============================================================================
Configuração Geral – Explicação:
===============================================================================
_______________________________________________________________________________
Arquivo: /etc/ssh/sshd_config
——————————
.
..
…

#### Para configurar a porta em que o SSH irá funcionar:
# What ports, IPs and protocols we listen for
Port 22

#### Para desabilitar o Listen em IPv6 pode-se colocar: ListenAddess 0.0.0.0
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
ListenAddress 0.0.0.0

## PermitRootLogin – permite ou não permite que o root faça login via SSH.
PermitRootLogin no

#|<<<<<<<<<<<<<< #### Configurando ####
### Especifica os usuários que podem fazer login
## Para permitir um usuário de uma máquina cliente específica
## coloque usuario@10.10.10.1
AllowUsers usuario1 usuario2 alessandro@10.10.10.1

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

### Habilita o X Forwarding (Redirecionamento de Display):
## Se não for utilizar é interessante desabilitar esta opção
X11Forwarding no

#|<<<<<<<<<<<<<< #### Configurando ####
#(Fonte: http://www.yaleman.org/2007/12/09/ssh-reverse-dns-lookup-disable/)
# Opcional
#>>>> Modificado:
### Colocado para não pesquisar no DNS, o nome do host que está conectando:
### (Realmente não é necessário modificar, só em caso de problemas)
#UseDNS yes
UseDNS no

#MaxStartups 10:30:60

## Se quiser desativar o servidor sftp, remova ou comente a linha:
## SubSystem sftp /usr/lib/sftp-server (que inicializa o sub-sistema ftp)
## do arquivo /etc/ssh/sshd_config e reinicie o servidor sshd.
# override default of no subsystems
Subsystem       sftp    /usr/lib/ssh/sftp-server

…
..
.
|———-^ Arquivo: /etc/ssh/sshd_config ———————————–|

===============================================================================
OpenSSH SFTP ou SCP com chroot() / ChrootDirectory
===============================================================================
>SFTP

Pacote: openssh-server (> 4.8p1)

|<<<<<<<<<<<<<< ==== OpenSSH SFTP ou SCP com chroot() / ChrootDirectory ====
_______________________________________________________________________________
Arquivo: /etc/ssh/sshd_config
——————————–
.
..
…
## PermitRootLogin – permite ou não permite que o root faça login via SSH.
PermitRootLogin no

## Especifica os usuários que podem fazer login
AllowUsers usuario1 usuario2

## Mude a linha:
Subsystem       sftp    /usr/lib/ssh/sftp-server
## Para:
Subsystem sftp internal-sftp

## Configure as seguintes linhas para o chroot()ing:
Match group sftponly
ChrootDirectory /home/chroot/%u
X11Forwarding no
AllowTcpForwarding no
# Veja: Erro 1 (OpenSSH SFTP chroot):
ForceCommand internal-sftp
…
..
.
|———-^ Arquivo: /etc/ssh/sshd_config ———————————–|

|<<<<<<<<<<<<<< ==== OpenSSH SFTP ou SCP com chroot() / ChrootDirectory ====
## Reiniciando o servidor de SSH:
/etc/init.d/ssh restart
# ou
invoke-rc.d ssh restart

## Criando o grupo sftponly
groupadd sftponly

## Crie o diretório /home/chroot
mkdir /home/chroot

## Modifique as permissões
chown root.root /home/chroot/

|<<<<<<<<<<<<<< ==== OpenSSH SFTP ou SCP com chroot() / ChrootDirectory ====
## Setando permissoes do diretorio:
chmod 755 /home/chroot

## Criando o usuário:
useradd –shell /bin/false –skel /etc/skel -d /home/chroot/userteste -m userteste -g sftponly

## Modificando a senha do usuário userteste:
passwd userteste

|<<<<<<<<<<<<<< ==== OpenSSH SFTP ou SCP com chroot() / ChrootDirectory ====
## Criando o diretório upload:
mkdir /home/chroot/userteste/upload

## Dando permissão no diretório para o usuário userteste:
chown userteste.sftponly /home/chroot/userteste/upload

|<<<<<<<<<<<<<< ==== OpenSSH SFTP ou SCP com chroot() / ChrootDirectory ====
## Para melhorar a segurança, pode-se limitar os usuários que podem acessar
## o servidor via SSH
## Então observe o arquivo: /etc/ssh/sshd_config

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Testando o acesso sftp
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
delfaflyer:~# sftp userteste@localhost
Connecting to localhost…
userteste@localhost’s password:
sftp> ls
upload
sftp> ls -la
drwxr-xr-x    3 0        0            4096 Sep  6 13:42 .
drwxr-xr-x    3 0        0            4096 Sep  6 13:42 ..
-rw-r–r–    1 0        0             220 Sep  6 13:37 .bash_logout
-rw-r–r–    1 0        0            3116 Sep  6 13:37 .bashrc
-rw-r–r–    1 0        0             675 Sep  6 13:37 .profile
drwxr-xr-x    2 1001     1002         4096 Sep  6 13:42 upload
sftp> cd /
sftp> pwd
Remote working directory: /
sftp> ls
upload
sftp>
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Erro 1 (OpenSSH SFTP chroot):
——————————–
Problema:
Nos clientes aparecem os seguintes erros:

WinSCP:
Cannot initialize SFTP protocol. Is the host running a SFTP server?

e

sftp:
Request for subsystem ‘sftp’ failed on channel 0

Causa:
Desconhecida

Solução:
Foi retirado a linha:
ForceCommand internal-sftp
do arquivo /etc/ssh/sshd_config
Ver: http://www.gossamer-threads.com/lists/openssh/users/43796
——————————————————————————-

Erro 2 (OpenSSH SFTP chroot):
——————————-
Problema:
Nos clientes aparecem os seguintes erros:

WinSCP:
Authentication log (see session log for details):
Using username “userteste”.

Authentication failed.

No arquivo de log do servidor:
debian5:~# cat /var/log/auth.log
Mar 22 23:26:02 debian5 sshd[2771]: Accepted password for userteste from 10.7.3.212 port 49516 ssh2
Mar 22 23:26:02 debian5 sshd[2771]: pam_unix(sshd:session): session opened for user userteste by (uid=0)
Mar 22 23:26:02 debian5 sshd[2773]: fatal: bad ownership or modes for chroot directory “/home/chroot/userteste”
Mar 22 23:26:02 debian5 sshd[2771]: pam_unix(sshd:session): session closed for user userteste

Causa:
A permissão no diretório /home/chroot/userteste estava errada.

Solução:
Foi alterada para chown root.root /home/chroot/userteste

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

|==========^ OpenSSH SFTP ou SCP com chroot() / ChrootDirectory ==============|

===============================================================================
Fazer scp, ssh sem utilizar senha:
===============================================================================
Tags: sem senha

VER: http://jimmyg.org/blog/2008/beginners-guide-to-ssh-keys-with-ssh2.html
Agent admitted failure to sign using the key.

[No Cliente]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
## (Fonte: http://www.debian-administration.org/articles/152)
## No CLIENTE deve-se gerar uma chave com o login que acessará o servidor:
ssh-keygen -t rsa
ssh-keygen -b 4096 -t rsa -f id_rsa_nome

## Será solicitado uma passphrase, não é obrigado a digitar:
Generating public/private rsa key pair.
Enter file in which to save the key (/home/usuario/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/usuario/.ssh/id_rsa.
Your public key has been saved in /home/usuario/.ssh/id_rsa.pub.

## Ainda no cliente edite o /etc/ssh/ssh_config e coloque a chave gerada (a
## privada) na diretiva IdentityFile assim:
# Provavelmente em seu arquivo este será o padrão e estará comentada:
IdentityFile ~/.ssh/id_rsa

## Agora copie a chave pública (que está guardada junto da chave privada
## gerada só que com o sufixo .pub) para /etc/ssh/authorized_keys no
## SERVIDOR SSH.
# Opções:
# 10.10.10.1 – IP do servidor;
#
ssh-copy-id -i ~/.ssh/id_rsa.pub aluno@10.10.10.1

## Saída do comando acima:
21
The authenticity of host ’10.10.10.1 (10.10.10.1)’ can’t be established.
RSA key fingerprint is 93:8b:11:df:67:e3:29:74:6c:0a:1b:f6:2e:3d:4b:99.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ’10.10.10.1′ (RSA) to the list of known hosts.
Password:
Now try logging into the machine, with “ssh ‘aluno@10.10.10.1′”, and check in:

.ssh/authorized_keys

to make sure we haven’t added extra keys that you weren’t expecting.

## Outro comando que poderia ser utilizado é o próprio scp da seguinte forma:
## Cuidado para não sobrescrever uma chave pré-existente
# Opções:
# -P – especifica a porta a ser utilizada;
# 10.10.10.1 – IP do servidor
scp -P 10022 ~/.ssh/id_rsa.pub aluno@10.10.10.1:/home/aluno/.ssh/authorized_keys

## Testando ##

## Pode-se testar da seguinte forma:
## Execute:
ssh suporte@10.10.10.1 uptime
12:05pm  up   3:08,  3 users,  load average: 0.39, 0.44, 0.44

## Se o comando não pedir senha e te mostra o resultado do
## comando uptime, significa que está OK

## DICA: ##
## Se quiser que mais de um cliente acesse sem senha concatene as
## chaves públicas no arquivo authorized_keys.

|
[Cliente - Fim]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

[No Servidor]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|

No servidor edite o arquivo /etc/ssh/sshd_config e sete:
_______________________________________________________________________________
Arquivo: /etc/ssh/sshd_config
——————————
.
..
…
RSAAuthentication yes
PubKeyAuthentication yes
AuthorizedKeysFile /etc/ssh/authorized_keys
…
..
.
+—————————————————————————–|

|
[Sevidor - Fim]

###############################################################################
# Gerenciando o Servidor de OpenSSH:
###############################################################################

===============================================================================
Iniciando o Serviço do OpenSSH:
===============================================================================

### Iniciando o Serviço de OpenSSH no SUSE:
rcsshd start

|==========^ Iniciando o Serviço do OpenSSH ==================================|

|##########^ Gerenciando o Servidor de OpenSSH ###############################|

###############################################################################
# Usando o SSH:
###############################################################################

===============================================================================
Usando o Cliente SSH:
===============================================================================

## Excutando comando remotamente: apaga o arquivo
ssh alessandro@10.10.10.1 -p 2222 rm -rfv /home/alessandro/arquivo

===============================================================================
Usando o scp:
===============================================================================

## Copiando o arquivo de uma máquina local para um servidor remoto (10.10.10.10)
# Opções:     -2 – Use o a versão 2 do procolo SSH
#        -4 – Use IPv4
#        -p – Mantenha o timestamp, dono do arquivo…
#        -C – Use a compressão para enviar o arquivo
#        -P – Use a porta especificada para conexão com o servidor
#        -v – Modo verboso
scp -2 -4 -pC -P 2222 -v /var/lib/vmware/ISOs/Fedora-11-i386-disc2.iso alessandro@10.10.10.10:/home/alessandro

## Copia um diretório de um servidor remoto para a máquina local:
scp -pr -P2228 alessandro@10.10.10.10:/disco2/backup/suse/alessandro/Musicas .

## Para iniciar o daemon do SSH em outra porta execute o comando:
/usr/sbin/sshd -p 445

## Opções do cliente SSH:

-N – Indicates no command, or tunnel only. If omitted, ssh would initiate a normal session

===============================================================================
Usando o ssh-keygen:
===============================================================================

### Para gerar uma chave privada e pública RSA:
# -b – tamanho da chave
# -t – tipo de chave
# -f – para especificar o caminho onde a chave será gerada
ssh-keygen -b 2048 -t rsa -f /home/alessandro/chavessh_rsa

|==========^ Usando o ssh-keygen =============================================|

###############################################################################
# SSHFS:
###############################################################################
>sshfs

### Instalando o SSHFS no Ubuntu:
apt-get install sshfs

### Para montar:
sshfs alessandro@10.10.10.117:/home/alessandro /home/alessandro/dir_local

### Erro:
tail -f /var/log/auth.log
internal-sftp[15146]: error: Invalid log level “NOTICE”

### Solução:
## Retirado a opção: -l NOTICE
#Subsystem sftp internal-sftp -f LOCAL7 -l NOTICE

fusermount: failed to open /dev/fuse: No such file or directory

modprobe fuse

http://www.guiadohardware.net/dicas/usando-sshfs.html

http://fuse.sourceforge.net/sshfs.html

http://en.wikipedia.org/wiki/SSHFS

Se você usa a montagem dos diretórios para acessar predominantemente arquivos de texto e outros formatos de arquivos sem compactação, pode agilizar o acesso usando a opção “-C”, que ativa o uso de compressão. Se a conexão estiver caindo depois de alguns minutos de inatividade, use a opção “ServerAliveInterval=30″, que faz com que o cliente mantenha a conexão aberta, enviando um pacote de dados a cada 30 segundos.

|##########^ sshfs ###########################################################|

###############################################################################
# Troubleshooting Geral:
###############################################################################
>Troubleshooting Geral

Ao logar via SSH em um servidor remoto aparece a seguinte mensagem:
Password change required but no TTY available.

Causa e Solução:

All     When you try to log in to w3.arizona.edu, you get the message
Password change required but no TTY available.
Your password has expired and you are using an FTP client, like SSH’s SFTP on a PC or Fugu on Mac OS X, but you cannot change your password with the FTP interface.You need to start an SSH shell client instead. Log in using your current (expired) password. You will be prompted again for your current password and then you’ll be prompted twice for your new password. If this technique fails, log into the U-System and enter the command
ssh Your_W3_Username@w3.arizona.edu
You’ll be prompted for your current password on W3 and a new one.
Fonte: http://www.u.arizona.edu/consult/ssh-tricks.html

## O erro scp: ambiguous target foi resolvido da seguinte forma: usado o comando scp e o caminho entre aspas duplas com a \ (barra invertida)
scp: ambiguous target

——————————————————————————-
### Erros Conhecidos: (Known Errors)

## Questão/Problema: (Question/Issue)

Por quê às vezes demora conectar?

## Sintoma: (Symptom)

Às vezes ao tentar conectar em um servidor SSH demora ser solicitado
a senha

## Causa: (Cause)

- O SSH faz uma consulta reversa (DNS Reverso) para descobrir o nome da
máquina que está conectando nela, veja a captura do tcpdump no
momento de uma conexão SSH:

———
tcpdump -nnn -i eth0 port 53

10:21:01.402892 IP 10.161.1.14.58727 > 10.10.10.10.53: 29513+ PTR? 212.10.10.10.in-addr.arpa. (41)
10:21:01.573877 IP 10.10.10.10.53 > 10.161.1.14.58727: 29513 NXDomain 0/1/0 (118)
———

tcpdump de um servidor de DNS que não responde:

———
tcpdump -nnn -i eth0 port 53
10:26:40.418664 IP 10.161.1.14.35550 > 172.16.154.1.53: 35926+ PTR? 212.3.7.10.in-addr.arpa. (41)
10:26:45.431546 IP 10.161.1.14.35550 > 172.16.154.1.53: 35926+ PTR? 212.3.7.10.in-addr.arpa. (41)
———

- O servidor pode está configurado para usar um servidor de DNS que não
responde

## Solução: (Solution)

Usar um servidor de DNS que esteja funcionando.

Sorry, but I did not have time to translate, then try to use “Google Translate”
and use Portuguese <> English: http://www.google.com/dictionary
|—————————————————————————–|

——————————————————————————-
### Erros conhecidos: (Known Errors)
## Questão/ Problema: (Question/Issue)

Loga no servidor SFTP, porém não consegue executar comando nem mudar de
diretório.

## Sintoma: (Symptoms)

Ao executar comandos usando o cliente de SSH para Linux, aparece a
seguinte mensagem de erro:

sftp> ls
Couldn’t get handle: Permission denied
sftp> cd upload
Couldn’t canonicalise: Permission denied

## Causa: (Cause)

A permissão estava errada no diretório do usuário.

Apesar do diretório estar no nome de um usuário, o dono e grupo dono
dele era para ser o root:

### Para mudar:
chown -Rv root.root /home/chroot/userteste/

## Solução: (Solution)

Para corrigir a permissão:

chown -Rv root.root /home/chroot/userteste/

|—————————————————————————–|

===============================================================================
Exemplos de Log:
===============================================================================

Debian 5.0: /var/log/auth.log

## Autenticação bem-sucedida:
Jan 20 16:00:00 debian-srv sshd[25406]: Accepted password for alessandro from 10.10.10.1 port 1378 ssh2
Jan 20 16:00:00 debian-srv sshd[25409]: (pam_unix) session opened for user alessandro by (uid=0)

## Exemplo de erro quando o usuário não está listado no AllowUsers:
Jan 20 16:03:13 debian-srv sshd[25467]: User alessandro from cliente.dominio.com.br not allowed because not listed in AllowUsers
Jan 20 16:03:13 debian-srv sshd[25467]: Failed none for invalid user alessandro from 10.10.10.1 port 1447 ssh2
Jan 20 16:03:24 debian-srv sshd[25467]: pam_ldap: error trying to bind as user “uid=alessandro,ou=grupo.pessoal,ou=dominio,dc=dominio,dc=com,dc=br” (Invalid credentials)
Jan 20 16:03:24 debian-srv sshd[25467]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cliente.dominio.com.br  user=alessandro
Jan 20 16:03:24 debian-srv sshd[25467]: pam_ldap: error trying to bind as user “uid=alessandro,ou=grupo.pessoal,ou=dominio,dc=dominio,dc=com,dc=br” (Invalid credentials)
Jan 20 16:03:24 debian-srv last message repeated 2 times
Jan 20 16:03:25 debian-srv sshd[25467]: Failed password for invalid user alessandro from 10.10.10.1 port 1447 ssh2

|==========^ Exemplos de Log =================================================|

###############################################################################
# Referências:
###############################################################################

AllowUsers:

http://www.freebsdblog.org/49/allowusers/

http://focalinux.cipsga.org.br/guia/avancado/ch-s-ssh.html

http://www.debian-administration.org/articles/590

Configurando SFTP com CHROOT no OpenSSH 5.x
(http://gutocarvalho.net/mediawiki/index.php/Configurando_SFTP_com_CHROOT_no_OpenSSH_5.x)

Configure the /etc/ssh/sshd_config file:

http://www.faqs.org/docs/securing/chap15sec122.html

problems with ChrootDirectory
(http://www.gossamer-threads.com/lists/openssh/users/43796)

Conexões SSH sem senha fácil e descomplicado:

http://www.vivaolinux.com.br/artigo/Conexoes-SSH-sem-senha-facil-e-descomplicado/

Backup automatizado e seguro usando SSH / SCP / SFTP

http://www.vivaolinux.com.br/artigo/Backup-automatizado-e-seguro-usando-SSH-SCP-SFTP/

Fazer scp sem senha:

http://lie-br.conectiva.com.br/pipermail/linux-br/2003-July/003589.html

Linux Security: (Muito bom site)

http://www.linuxsecurity.com/content/view/124601/2/

Password-less logins with OpenSSH:

http://www.debian-administration.org/articles/152

Securing SSH:

http://fedorasolved.org/post-install-solutions/securing-ssh

|##########^ Referências #####################################################|

###############################################################################
# Verificar:
###############################################################################

expect

http://v2.robbyt.com/2008/howto/chrooted-sftp-with-openssh-5/

###############################################################################
# Perguntas para Implementação:
###############################################################################

Qual porta o SFTP irá usar?

|##########^ Perguntas para Implementação ####################################|

###############################################################################
# Dúvidas:
###############################################################################

Como evitar que o usuário apague um arquivo de um servidor SFTP?

Como permitir que o usuário SFTP consiga alterar a senha?

|##########^ Dúvidas #########################################################|

###############################################################################
# Scripts:
###############################################################################

## Script para criar um usuário para um servidor SFTP:
_______________________________________________________________________________
Arquivo: /scripts/usersftp.bash
——————————–
#!/bin/bash

DIRCHROOT=/home/chroot
SFTPONLY=sftponly

echo
echo “Digite o nome de usuario: “
read USER

useradd –shell /bin/false –skel /etc/skel -d $DIRCHROOT/$USER -m $USER -g $SFTPONLY

echo -n “Modificando o dono e grupo dono do diretorio $DIRCHROOT/$USER”
chown root.root $DIRCHROOT/$USER && echo ” [ OK ] “

echo -n “Criando diretorio \”upload\” do usuario $USER”
mkdir $DIRCHROOT/$USER/upload && echo ” [ OK ] “

echo -n “Modificando o dono e grupo dono do diretorio $DIRCHROOT/$USER/upload”
chown $USER.$SFTPONLY $DIRCHROOT/$USER/upload && echo ” [ OK ] “

echo
echo “Digite uma senha para o usuario: “
passwd $USER
——————————————————————————-