HOWTO create an anonymous sftp server with ssh-3.x
==================================================
Author: Sami Lehtinen <sjl@ssh.com>
Created: Thu Oct 18 18:21:56 2001

1.  Create a dedicated user account for the guest user (e.g. "ssh-guest").
   
      % pw useradd ssh-guest -m -s /nonexistent [-d homedir] [-u uid] [-g group]
   
    Remember that the home directory will be the root ("/") of the
    chrooted environment, so choose wisely (you can change it later, of
    course).
   
2.  Set some known password (e.g. "guest") for the account with "passwd".
   
      % passwd ssh-guest
    
3.  Modify /usr/local/etc/ssh2/sshd2_config. Add the following line:
   
      ChRootUsers ssh-guest
   
4.  If you wish, you may announce the existence of this account in your
    login banner message. The file /usr/local/etc/ssh2/ssh_banner_message,
    if not empty, will be displayed to incoming users before they
    authenticate. Or you can change the default by modifying the
    /usr/local/etc/ssh2/sshd2_config:
    
      BannerMessageFile /usr/local/etc/ssh2/some_other_ssh_banner_message
   
    As an example, this is what is output by ssh with my test setup:
   
      --snip--    
      johto (21:30) ~>sftp ssh-guest@johto
      This is Johto.
      
      Anonymous SFTP access allowed to "ssh-guest" user account. The
      password is "guest". Upload access to directory "/pub/upload".
      
      Have fun.
      
      ssh-guest@johto's password: 
      --snap--

    Remember that you may use subconfiguration files to change a banner
    message based on e.g. user name (xxx example file).

5.  You most probably want to restrict access to read-only. For this,
    change the accounts owner to something else (e.g. root):
   
      % chown -R root:root ~ssh-guest
   
    If you want to give some directories write access, change ownership of
    those to "ssh-guest".
   
6.  To enable logging, you have to add the following line to sshd2_config
    (or possibly to a subconfig file (see sshd2_subconfig(5))):
   
      SftpSysLogFacility  <facility>
   
    <facility> could be LOCAL7, or whatever you wish. See sshd2_config(5)
    for additional documentation.
   
7.  Add your sftp-server to sshd2_config (if not already there):

      subsystem-sftp internal://sftp-server

8.  Remember to restart the sshd2 daemon after you modify the configuration
    file for the changes to take effect!

Have fun.
