The below will allow sftp with no password and chroot user into users directory using jailkit.

Host server

 
ssh-keygen -t rsa 

Copy public key to remote server:

 
ssh-copy-id -i ~/.ssh/id_rsa.pub username@remotehost

This puts the public keys into the remote servers home directory of the specified user. Usually inside .ssh/authorized keys. *make sure the remote user has already been added

To manually copy a key or insert a public key passed by a customer:

 
scp ~/.ssh/id_rsa.pub root@remoteserver:/root 

Remote server

2. Inside the specified users home directory create a .ssh directory

mkdir /home/userdir/.ssh 

3. Create a file called authorized_keys inside .ssh

touch /home/userdir/.ssh/authorized_keys 

4. Insert the contents of id_rsa.pub into authorized_keys

cat /root/id_rsa.pub >> /home/userdir/.ssh/authorized_keys 

This will give remote access to the remote server and drop you into the users directory

vim /etc/passwd 

Set the specified user /bin/false e.g.

user:x:5001:5002::/path/to/directory/web:/bin/false

Now we need to modify the sshd_config file:

vim /etc/ssh/sshd_config

Change Subsystem sftp /usr/lib/openssh/sftp-server to

Subsystem sftp internal-sftp 

*Append the following to the bottom of the file:*

Match Group sftp
ChrootDirectory /path/to/directory/web
AllowTCPForwarding no
X11Forwarding no
ForceCommand internal-sftp 

Now we need to set ownership and permissions:

chown user:root /home/user

chown user:root /home/user/.ssh

chown user:root /home/user/.ssh/authorized_keys

chmod 775 /home/user

chmod 700 /home/user/.ssh

chmod 600 /home/user.ssh/authorized_keys

That should be everything. Try to ssh or sftp to the remote host from the original host. You should be dropped straight into the specified directory and unable to move anywhere outside of it.

I came accross this issue when the Port Forwarding rules reached roughly 200.

The problem I had was when I added new rules past 201 (201,202,203 etc.) the Firewall would add them to the interface but the IPtables actually ignored them.

As you can imagine this was incredibly frustrating to the point a second Smoothwall Firewall was installed but the same problem returned.

From chatting with the guys on the smoothwall community ( Smoothwall) they were able to point me in the direct and instructed me to run the following from commandline:

sed -i -e 's=t-/var/log=t/var/log=' /etc/syslog.conf
kill -SIGHUP `cat /var/run/syslogd.pid`

Essentially concluded that due to massive log traffic Smoothwall was struggling to write the new port forwarding changes. The above puts a hyphen before each log file name; this is supposed to tell syslogd not to wait for the entry to reach the disk (turns off O_SYNC). The second tells syslog to close, re-read its .conf and reinitialize. If it doesn’t work, you’ll have to reboot when convenient.

I can’t take any credit for this one, “fest3er” came up with the idea on the forum.

See here: http://community.smoothwall.org/forum/viewtopic.php?f=56&t=38789

If you are having an issue with a slow MySQL connection to a remote database then perhaps the following can help.

Essentially my website was taking 7-8 seconds to load and the Apache logs weren’t giving me much to go on. Using a website page test tool such as http://www.webpagetest.org I could see that the site itself was performing well but there was a 7 second server wait time.

This lead my on to the assumption that the MySQL connection was causing the issue. To test, I simply created a new database locally and updated the config files. What do you know…the website loads instantly. This confirmed my assumption.

So I set about figuring out why the MySQL connection was so slow even though the remote server was within the same network. The fix is very simple:

Edit the hosts file on the remote MySQL server:

vim /etc/hosts

Add in the following line:

xxx.xxx.xxx.xxx original.host.com original 

* xxx being the IP address

The original host being the server you are connecting from. Go back and check your website hopefully everything is back to full speed.

The main reason for adding the entry to the hosts file is due to not having reverse DNS set up. Once the entry has been added manually this will do the lookup manually rather than querying the DNS.

More useful information can be found here: http://etwiki.cpanel.net/twiki/bin/view/11_32/WHMDocs/SetupRemoteMySQL

The below bash script, when executed, will check the % of disk space usuage of the complete filesystem and email a specified email address if more than 80% full.

Pre-req – create fs_report.log inside /var/log/

i.e.

 
touch /var/log/fs_report.log 

Create a new bash script:

 
vim /path/to/script/diskspace.sh 

Replace the email address or modify the disk space below as needed:

#!/bin/bash
#
#Extract % use for the filesystem
#Send email warning to if the raid is 80% or more full
#Include Folder/File sizes of the filesystem directory contents
#
df -h | awk '{ print $5 }' | cut -d'%' -f1 | while read usep; do
if [ $usep -ge 80 ]; then
echo "***$(hostname) is $usep% FULL at $(date)" > /var/log/fs_report.log
echo "***Please remove unnecessary data from $(hostname)" >> /var/log/fs_report.log
echo "***Detailed Folder/File size for BackupServer content:" >> /var/log/fs_report.log
df -h >> /var/log/fs_report.log
mail -s "WARNING-bksvr2 $usep% FULL" backup@mydomain.com < /var/log/fs_report.log -- -f "backup@mydomain.com"
fi
done

*Make sure to make the script executable:

chmod +x diskspace.sh

To automate this script add a cron job to run it on a regular basis:

0 8 * * * /path/to/script/diskspace.sh

The above cron job will run the script at 8am everyday.

This is a must have for any Smoothwall Express Setup. This mod gives you full control of your interfaces including mutliple IP addresses, ports and mac control:

The mod gives ultimate control with the following:

1. Specify origin source IP/Network
2. Specify the origin/destination ports to be open for your specific IP/Network

e.g. Open access for the IP 222.111.55.333 on port 57 to your IP xxx.xxx.xxx.xxx on port 22

To install the mod simply run the following from commandline:

wget http://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/stans-smoothwall3mods/fullfirewall-3.3.3.1-Express-3.0-i386.run
sh ./fullfirewall-3.3.3.1-Express-3.0-i386.run 

**NOTE: Smoothwall Express 3.0 should be up to and including update 9 – Maintenance > Updates.

Log back into the Smoothwall GUI and you will now see the Full Firewall Control interface.

For further reading take a look at the smoothwall community here