Limiting User to SFTP for Uploading Web Content

I required the following:

  • System user that could upload content to a directory in root web directory (default root: /var/www/html)
  • Limit user from interactive SSH
  • Limit user from other areas of OS

Specifically, I am working within the AWS distribution on a hosted EC2 instance.

I found posts online that accomplished part of what I needed. But my steps to achieving this were:

  1. Create the user. In my case, user webpub. This creates an entry in /etc/passwd as well as a home directory under /home: 
    sudo useradd webpub
  2. These next few steps I found here. Create a ‘jail’ directory that we will constrain the user. I created it in /var.
    sudo mkdir /var/jail
  3. An important note is that the jail directory and all directories beneath it must be owned by user root in order for the Chroot declaration to work. If you get setup and notice that you are correctly authenticating but then the connection immediately drops, this could be your problem. Now create a sub-directory that will serve as the access point for the user to the web content:
    sudo mkdir /var/jail/www
  4. The directory created above can also be owned by root. Create a sub-directory under web content root that we will restrict this user to. In this case, the same name as the user:
    sudo mkdir /var/www/html/webpub
  5. The directory created above can also be owned by root. Now create the link between the jail and the content directory by binding the two:
    sudo mount -o bind /var/www/html/webpub /var/jail/www
  6. In /etc/passwd, update the user webpub‘s home directory (where they will land upon logging in) to /var/jail/www.
  7. Update /etc/ssh/sshd_config to jail the user upon logging in. Start by commenting the line Subsystem sftp /usr/libexec/openssh/sftp-server and then adding configuration for the internal-sftp sub-system. When done, it will look like (commented line and all): 
    #Subsystem sftp /usr/libexec/openssh/sftp-server
    Subsystem sftp internal-sftp
    Match User webpub
            ChrootDirectory /var/jail
            ForceCommand internal-sftp
            X11Forwarding no
            AllowTcpForwarding no
  8. The ChrootDirectory jails the user while ForceCommand internal-sftp lists the user to only being able to login via SFTP. Now restart openssh:
    sudo /etc/init.d/sshd restart
  9. In my setup, I have password authentication disabled, so the last step is create a private/public key pair and install client/server side. Remember that authorized_keys (and its parent directory .ssh) must reside in the home directory for webpub, which we set earlier as /var/jail/www. Since that directory is bound to /var/www/html/webpub, though, these artifacts reside in the latter directory.

Ubuntu Yielding Noisy Black/White Scans

I did a fresh install of Ubuntu 14.10 today with Cinnamon as a desktop and am pleased with the interface.

I noticed something when scanning some documents in lineart mode, though: the resulting images had a ton of noise, noise that I did not see in scans prior to my upgrade. After snooping around the various options in the gscan2pdf application, I stumbled upon this one which, when toggled, causes the noise to disappear: Disable dynamic lineart. After checking that box, my scans seem to be noise free.

Default Argument Value Does Not Refresh Between Function Calls

Something struck me as unexpected today while working in Python. I had a function to take a datetime object and convert it into epoch milliseconds:

import datetime
import time

this_tz = 'US/Eastern'

def get_epch_ms(
    # Returns milliseconds since epoch for datetime object passed.
    # If no argument is passed, uses *now* as time basis.

    return int(time.mktime(dttm.astimezone(pytz.timezone(this_tz)).timetuple()) * 1000.0 + round(dttm.microsecond / 1000.0))

This function works fine: call it with get_epch_ms() and the epoch millisecond value for *now* is returned; however, I noticed during subsequent calls to the function within the same execution of the broader application that the value of dttm did not update each time. I.e., it appears as if the logic used to populate a default value – – was executed only during the first call to the function, and that same value was used for subsequent calls. It took me a bit to track this down, not sure if it’s just something I’ve never come up against before.

The fix is simple enough, though involved a couple of additional lines of code:

import datetime
import time

this_tz = 'US/Eastern'

def get_epch_ms(dttm=None):
    # Returns milliseconds since epoch for datetime object passed.
    # If no argument is passed, uses *now* as time basis.
    # Refreshes 'dttm' between calls to this function.

    if dttm is None:
        dttm =

    return int(time.mktime(dttm.astimezone(pytz.timezone(this_tz)).timetuple()) * 1000.0 + round(dttm.microsecond / 1000.0))

The updated function properly provides an updated timestamp at each invocation, when called as get_epch_ms().

Right and Wrong, Politically Speaking

A friend recently advanced the notion that one of our political parties is more “right” than the other when it comes to economic policy. As an admitted layman in economics, I disagree:


Interesting that you’d specifically mention macroeconomic policy, as it may be considered particularly confounding as the subject of an exercise seeking to discern “right” from “wrong.” Approaches and proposals – along with underlying principles – vary between the two major political parties, sure, but to unequivocally deem one as altogether more economically sound or, dare I say it, *enlightened* than the other seems disingenuous.

From the 2008 economic stimulus to recent quantitative easing, I could line up for you an equivalent number of economics doctoral degrees and professional accolades on either of two polarized viewpoints. “The amount of the stimulus should be doubled.” “There should be no stimulus at all.” “QE is critical in loosening credit markets.” “QE encourages risky investment at exactly the wrong time.” No statement above is correct, none is incorrect; each has sound economic theory which can (and has) been cited in its favor.

More to the point, if there were instilled in me a personal bias, I could line up for you a greater number of economic doctoral degrees and profession accolades on either side of two polarized viewpoints, the viewpoint of my choosing. This is convenient for my political agenda; I can leverage the sheer complexity and, really, nuance attached to (macro)economics to form in the shroud a convincing argument that serves my purpose. It is not crucial for my agenda that my argument be “right;” it is more important that it be polarizing, feigning a bright line where none exists.

Economics is fodder for this, as it can be so difficult to quantify. Compounding the matter is the fact that meaningful retrospection is tough because causality is so elusive. As for “right” and “wrong,” though, neither is neither. The “whole point” I originally mentioned (somewhat in passing, wasn’t it?) alludes to the fact that we are constructed (politically) so that powers (i.e., parties) – neither more correct than the other – gnash teeth and thump chests, fighting with equal conviction to accomplish their respective myopic visions and, in doing so, arrive at something in between. Neither party was meant to succeed entirely, nor would we want them to; even the staunchest partisan would find him or herself regretting the unilateral success of his or her own party.

Gaming System Builds (~$500 and ~$1000)

Recently, a couple of friends have tapped me (or did I volunteer?) to spec out parts for a new gaming rig. The first friend was looking in the $500-600 range in order to get his League of Legends on, the second wants to replace his aging PC before the WoW expansions drops in a week or two. I figured I would capture here what I came up with.

The $500 (oh, okay, “sub-$600″) gaming rig.

This did prove a little challenging. The price point is low enough where some serious consideration has to be given to where to cut corners and still outfit what can be considered a complete PC. Admittedly, I assembled this list a few months ago, so prices may have dropped and “best value” components shifted a bit since then (gotta love technology).

Motherboard: ASUS M5A97 R2.0 Socket AM3+ ATX ($90)

CPU: AMD FX-6300 Vishera 6-Core 3.5GHz (4.1GHz Turbo) Socket AM3+ ($110)

Video Card: EVGA 02G-P4-2742-KR GeForce GT 740 Superclocked 2GB 128-Bit DDR3 ($90)

Memory: CORSAIR Vengeance 8GB 240-Pin DDR3 SDRAM DDR3 1600 (PC3 12800) ($80)

Power Supply: CORSAIR CX series CX600 600W ATX12V v2.3 ($80)

Hard Drive: Seagate Barracuda ST1000DM003 1TB 7200 RPM 64MB Cache SATA ($55)

Optical Drive: Asus or Samsung ($20)

Case: Antec Three Hundred ($65)

Total cost: $590


Upgrades that could be made to the above:

Video Card: EVGA 03G-P4-2667-KR G-SYNC Support GeForce GTX 660 FTW Signature 2 3GB 192-bit GDDR5 (+$90)

CPU/Motherboard: Upgrade to Intel i5 (+$150)

New total cost: $830


Downgrades that could be made to above:

Motherboard: Asus to MSI (-$20)

PSU: 600w to 500w PSU (-$15)

Memory: 8GB to 4GB (-$40)

New total cost: $515


The $1k gaming rig.

A little more breathing room here, but (and it’s a big ‘but’) this particular friend has his sights set on a Core i7. There goes about a third of the budget.

He was also looking at a pre-built (some great values to be had here) system, the ASUS M32AD-US032S Desktop PC, selling for $969, which comes with the following specs:

Intel Core i7 4790 (3.6GHz)

Chipset: Intel H81


Windows 8.1 64-Bit

NVIDIA GeForce GT 740 4 GB

300W PSU

I sought to come up with a similarly priced alternative that might be more tuned to the discerning builder/gamer. A few notes driving my decision-making:

  • The box above is put together by Asus, and Asus knows what it’s doing. I’m fairly certain it’s going to run your games just fine, and right out of the box, no less. That said…
  • 300w struck me as a borderline. Again, I’m sure the PC is going to run fine, but how about a little overhead for those future upgrades?
  • I couldn’t find much information on the specific components actually used…I’m going to go ahead and venture they’ll be mainly Asus, but who knows. When *I* build a system, though, I _do_ know.
  • There is some real value here to those who need a Windows license, which are running north of $100 a pop right now. I disregard such license in my builds, but if you need one, that’s $100 right off the bat.
  • Input devices. It’s not much of a consideration for me – I like to latch onto my own – but the Asus prebuilt comes with keyboard and mouse.

My answer to the Asus pre-built:

CPU: Intel Core i7-4790 Haswell Quad-Core 3.6GHz LGA 1150 ($310)

Video Card: EVGA 03G-P4-2667-KR G-SYNC Support GeForce GTX 660 FTW Signature 2 3GB 192-bit GDDR5 ($180)

Motherboard: ASUS Z97-A LGA 1150 Intel Z97 ($150)

Memory: CORSAIR Vengeance 8GB 240-Pin DDR3 SDRAM DDR3 1600 (PC3 12800) ($80)

Power Supply: CORSAIR CX series CX600 600W ATX12V v2.3 ($80)

Hard Drive: Seagate Hybrid Drive ST1000DX001 1TB MLC/8GB 64MB Cache SATA ($80)

Case: Antec Nine Hundred ($95) or Antec Three Hundred ($65)

Total cost: $975

The above gets you into features offered by the Z97 chipset that the H81 does not have. I also give the video card a pretty serious bump. I cut corners with memory, going from 16GB to 8GB. Some people will scream about this, but 8GB is going to be fine right now and RAM is a straightforward upgrade down the line. I spec a robust power supply with room to grow, and an accompanying big, cool, quiet Antec Nine Hundred. I sacrificed some storage in exchange for the speed benefits of Hybrid. If you’re hoarding media, that might prove unpalatable, but I might also recommend going out and getting a giant, slow(er) drive for such things (unless you’re doing a bunch of editing of said media, etc., in which case you’re peripheral to my target audience, anyway).


As usual, I’m amazed at the caliber of hardware that can be gotten for a reasonable price. I put a rig together about four years ago, in that ~$1k range, and it still goes strong with WoW (the only game I still really play, on occasion) cranked. The more demanding games, running at higher resolutions (1080p widescreen, etc.) than what I’m running would make it sweat, I’m sure, but my general point is that you can reasonably expect to get some quality time from a system in this range. Even the “sub-$600″ system offers some upgrade paths that will keep you chugging for a bit.

Ubuntu and VNC

I seem to occasionally find myself sparring with Ubuntu on getting VNC server configured correctly. I use the default (RealVNC) vncserver package included with Ubuntu. There are two main points of configuration I seem to rediscover each time:

Make sure vncserver is looking in the right place for configuration

For my setup, the “right” place means ~/.vnc/xstartup. I’ve seen vncserver look to /etc/X11/Xsession by default. To change this, make sure the following line is in /etc/vnc.conf:

$vncStartup = "~/.vnc/xstartup";

Now you need to make sure the configuration exists in your user home directory. Following is the contents of ~/.vnc/xstartup (note: there are several commented lines I leave there for posterity:

# Uncomment the following two lines for normal desktop:
#exec /etc/X11/xinit/xinitrc
#gnome-session --session=gnome-classic &
[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
xsetroot -solid grey
vncconfig -iconic &
#x-terminal-emulator -geometry 1280x1024+10+10 -ls -title "$VNCDESKTOP Desktop" &
#x-window-manager &
startxfce4 &

Then I just have a simple script in my home directory to start a vnc session, looks something like this:

vncserver :1 -geometry 1440x900 -depth 16 -name my_lil_desktop


EDIT (2015-01-23) : Today I installed version 14.10 of Ubuntu. By default, it uses the ‘vino’ application for remote desktop tasks. It did not work out of the box for me, and this seemed to be the case for many, based on what I read online. At any rate, I fell back to the configuration described in this post but had to install vnc4server first, as it was not installed along with 14.10. I initially tried tightvncserver but it did not work with this configuration; vnc4server, however, did.

Asus RT-AC68R Periodically Drops Wireless (2.4GHz) Connection

This does not strike me as specific only to this router, but has to do with a configuration setting around 20MHz vs. 40MHz channel bandwidth.

I picked up an Asus RT-AC68R a while back and it’s been fantastic. One bit of behavior I wasn’t crazy about was the periodic – and somewhat frequent – dropping of the wireless connection. This happened with multiple devices (all of which happened to be Apple). I read around a bit online and there were a few suggestions, ranging from configuration to third-party firmware, but the one I homed in on had to do with channel bandwidth. I live in an urban environment and there are many APs within range of me. Evidently, by default, the Asus comes configured with 2.4GHz to use a channel bandwidth of 40MHz (or 20/40) as opposed to a strict 20MHz bandwidth, and this has been identified as a potential issue in crowded AP environments. I limited the channel bandwidth to the more concise 20MHz and my dropped connections have disappeared in the weeks since.

BBC Questions the Harm of Fat In One’s Diet

Not as amusing as an emotionally-fueled blog post with misguided assertions and misrepresentations, but interesting, nonetheless; I like dietary advice like I like my wine: dry.

It comes back to variety and moderation. Statements indicating unequivocally that food or ingredient X is “bad for you,” advocating for complete elimination with no mention of dosage or consumption rate, are invariably arbitrary and lack thoughtfulness; as so many things in life, it’s just not that simple.

I enjoy the fact that through the fads and in the face of growing mountains of research, the tried-and-true Mediterranean diet (full disclosure of personal bias, here!) continues to withstand scrutiny.

Web Browser Cookies Between Sessions (IE, Firefox, Chrome)

Was looking into this for a client, and I’ve come to the following conclusion based on various reading across the ‘tubes:

How cookies are handled between browser instances varies between web browsers. Why do we care? Well various web applications are going to get wonky if you try opening multiple instances of them when those instances share cookies. And by “wonky” I mean it’s just not going to work. So isolating browser instances allows us to have multiple sessions of that web application open simultaneously.

Internet Explorer

IE7 does *not* share cookies if you start another instance of it (e.g. double-clicking on the icon when an instance is already open) but will share them across tabs or if you use “New Window” to open new window.

IE8 *does* share cookies between instances by default, but it can be made to not do this by either:

– Going to File–>New Session

– Starting IE8 with “iexplore -nomerge” (custom shortcut)

Mozilla Firefox

It would appear Firefox shares cookies between tabs and windows if those windows are created under the same Firefox profile. If you’re like me (and using Firefox), you probably only have one Firefox profile setup for yourself. You can force Firefox to use a different profile by creating a custom shortcut that looks like this:

firefox.exe -no-remote -p “myProfile2″

where myProfile2 is the name of the profile you want Firefox to use. If the profile does not exist, Mozilla will bring up the profile management tool which will let you create it. From then on you can then open two instances of Firefox, running under two different profiles, which will *not* share cookies and, thus, will allow you to run two simultaneous sessions of your favorite web application (I know what mine is).


Allegedly, Chrome shares cookies between instances unless you use its Incognito feature by clicking on the wrench and going to “New Incognito Window” (Ctl-Shift-N).

1 2 3 8