4.1. Overview

To configure MySecureShell, you need to edit the /etc/ssh/sftp_config file. By default MySecureShell comes with a commented example configuration. This may not match all your needs and you will need to modify it to get it working as expected.

The configuration is made with 2 importants kinds of tags:

  • Parent tags (level 1): defining a global context
  • Child tags (level 2): defining a specific option for the parent tag

Configuration files should looks like this:

<ParentTag [parameter]>
    ChildTag    value
</Parent>

4.1.1. Parent tags

Tags Values Summary
Default None Default values will be applyed for all other parents tags
FileSpec filter name Allow to create filter on files
Group group name Allow a group
IpRange IP/CIDR Allow a set of range IP address
User user name Allow a user
VirtualHost FQDN Allow a VirtualHost

4.1.2. Child tags

Tags Values Summary
ByPassGlobalDownload false/true Bypassing GlobalDownload value
ByPassGlobalUpload false/true Bypassing GlobalUpload value
CanChangeRights false/true Allow to change rights on files and directories
CanChangeTime false/true Allow to change access and creation time on files and directories
Charset <charset> Enable special charset compatibility
ConnectionMaxLife <unix rights> Limit maximum connection time in seconds
CreateHome false/true Create home user’s directory if it doesn’t exist
DefaultRights <unix rights> Set default rights on new files and folders created
DirFakeGroup false/true Substitute shown group owner name of files and directories, by the name of the connected user
DirFakeMode xxxx Substitute shown rights of files and directories, by those ones
DirFakeUser false/true Substitute shown user owner name of files and directories, by the name of the connected user
DisableAccount false/true Quickly disable an account
DisableMakeDir false/true Disable new directories creation
DisableOverwrite false/true Disable file’s overwriting
DisableReadDir false/true Disable reading directories
DisableReadFile false/true Disable reading files
DisableRemoveDir false/true Disable removing directories
DisableRemoveFile false/true Disable removing files
DisableRename false/true Disable renaming files and directories
DisableSetAttribute false/true Disable changing attributes on files and directories
DisableSymLink false/true Disable creating symbolic link
DisableWriteFile false/true Disable writing files
Download <integer><units> Download bandwidth by connected user
ExpireDate <date> Expiration date
ForceGroup <groupname> Force group assignment for connected user
ForceRights <unix rights> Force rights assignment for connected user
ForceUser user Force user assignment for connected user
GlobalDownload <integer><units> Maximum allowed bandwidth in download for the server
GlobalUpload <integer><units> Maximum allowed bandwidth in upload for the server
HideNoAccess false/true Hide not allowed permissions files and directories
Home <path> Change home of users.
IdleTimeOut <integer> Inactivity timeout before deconnection in seconds
IgnoreHidden false/true Show hidden files and directories (starting with a dot)
Include <path> Include another configuration file
IsAdmin false/true Allow to be administrator
IsSimpleAdmin false/true Allow to be administrator (less righs than IsAdmin tag)
LimitConnection <integer> Limit the number of simultaneous connections
LimitConnectionByIp <integer> Limit the number of simultaneous connections by IP
LimitConnectionByUser <integer> Limit the number of simultaneous connections by user
LogFile <path> Allows to change the file of log
LogLevel_ <integer> Allows to change the loglevel of log
LogSyslog false/true Write log to syslog
MaxOpenFilesForUser <integer> Limit maximum opening files simultaneously
MaxReadFilesForUser <integer> Limit maximum reading files simultaneously
MaxWriteFilesForUser <integer> Limit maximum writing files simultaneously
MaximumRights <unix rights> Set a maximum rights on new files and folders created (unix rights format)
MinimumRights <unix rights> Force minimum rights for new files and new directories (unix rights format)
ResolveIP false/true Resolve IP address from DNS
SftpProtocol <integer> Force the SFTP protocol version
Shell <path> Specify a Shell path to allow users to have a real shell
ShowLinksAsLinks false/true See symbolic links as true files or folders
StayAtHome false/true Restrict user to stay in its home directory and subdirectories
Upload x(units) Upload bandwidth by connected user
VirtualChroot false/true Chroot users in their Home directory
CallbackDownload <shell command> Call a command when download completes
CallbackUpload <shell command> Call a command when upload completes

4.1.3. Deprecated tags

Those tags are deprecated and don’t work anymore!

Tags Values Summary
CanRemoveDir false/true Allow to remove directories
CanRemoveFile false/true Allow to remove files
GMTTime <+/-><integer> Adjusts the clock of the log
HideFiles <regex> Hide files / directories that you want using a regular expression (regex)
PathAllowFilter <regex> Restricted access to files / directories using regular expression (regex)
PathDenyFilter <path> Do not authorize files/directories which match with the regular expression