How To Install Scponly on Rocky Linux 9

In this tutorial, we will show you how to install Scponly on Rocky Linux 9. For those of you who didn’t know, Securing file transfers is a critical aspect of maintaining a robust and safe Linux server environment. Scponly is a versatile tool that allows system administrators to restrict user access to only secure copy (SCP) and secure FTP (SFTP) protocols, effectively preventing users from accessing the command line interface.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Scponly on Rocky Linux 9 or RHEL-based.

Prerequisites

• A server running one of the following operating systems: Rocky Linux 9.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• An active internet connection. You’ll need an internet connection to download the necessary packages and dependencies.
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Scponly on Rocky Linux 9

Step 1. To begin the installation process, update your system’s package lists by running the following command:

sudo dnf update
sudo dnf install epel-release

Next, install the necessary prerequisites using the dnf package manager:

sudo dnf install wget gcc man rsync openssh-clients

Step 2. Installing Scponly on Rocky Linux 9.

Change to the /opt directory, which is commonly used for installing optional software packages:

cd /opt

Download the latest version of scponly using wget:

wget http://sourceforge.net/projects/scponly/files/scponly-snapshots/scponly-20110526.tgz

Extract the downloaded archive using the tar command:

sudo tar -zxvf scponly-20110526.tgz

Change to the extracted scponly source directory:

cd scponly-20110526

Run the configure script with the recommended options:

sudo ./configure --enable-chrooted-binary --enable-winscp-compat --enable-rsync-compat --enable-scp-compat --with-sftp-server

Compile scponly using the make command:

sudo make

Install the compiled binaries and configuration files:

sudo make install

Add the scponly shell to the list of allowed shells in /etc/shells:

echo "/usr/local/bin/scponly" | sudo tee -a /etc/shells

Step 3. Create Scponly User and Group.

Create a dedicated group for scponly users: sudo chmod 755 /home/scponly

sudo groupadd scponly

Create a new user account for scponly:

sudo useradd -g scponly -s /usr/local/bin/scponly -d /home/scponly -m scponly

Set a password for the scponly user:

sudo passwd scponly

Configure the scponly user’s home directory permissions:

sudo chmod 755 /home/scponly

Step 4. Configure Scponly Chroot and Logging.

Chroot, or change root, is a security feature that restricts a user’s access to a specific directory, preventing them from navigating to other parts of the filesystem. To set up a chroot environment for scponly, create the necessary directories:

sudo mkdir -p /home/scponly/dev
sudo mknod -m 666 /home/scponly/dev/null c 1 3

Set the ownership and permissions on the chroot directory:

sudo chown -R root:root /home/scponly
sudo chmod -R 755 /home/scponly

To enable logging for scponly, edit the rsyslog configuration file:

sudo nano /etc/rsyslog.conf

Add the following lines at the end of the file:

local5.* /var/log/scponly.log

Save the file and exit the editor. Restart the rsyslog service to apply the changes:

sudo systemctl restart rsyslog

Step 5. Test Scponly Configuration.

To test your scponly configuration, attempt to log in via SSH using the scponly user account:

ssh scponly@your_server_ip

You should be greeted with a restricted shell, indicating that scponly is working correctly.

Next, test file transfers using scp:

scp test_file.txt scponly@your_server_ip:/home/scponly/

Verify that the file was successfully transferred to the scponly user’s home directory.

Confirm that file operations are being logged by checking the scponly log file:

sudo tail -f /var/log/scponly.log

Congratulations! You have successfully installed Scponly. Thanks for using this tutorial for installing the Scponly on your Rocky Linux 9 system. For additional help or useful information, we recommend you check the official Scponly website.