OpenSSH SFTP Server for Config Archiving with Chroot

Install Software and Initialize the Environment

sudo su -
apt-get install git rssh
git clone https://github.com/nkadel/rssh-chroot-tools.git
mkdir /var/backups
./rssh-chroot-tools/mkchroot.sh /var/backups
mkdir /var/backups/home
groupadd --system backups

Configure OpenSSH Server

Edit /etc/ssh/sshd_config:

PasswordAuthentication yes
Match group backups
    AllowTcpForwarding no
    X11Forwarding no

Restart OpenSSH: systemctl restart ssh

Configure RSSH

Edit /etc/rssh.conf:

Leave any chrootpath = lines commented out.

allowscp
allowsftp
umask = 077

Create User(s)

useradd --create-home --base-dir /var/backups/home --shell /usr/bin/rssh --groups backups <hostname>
passwd <hostname>
./rssh-chroot-tools/mkchroot-passwd.sh /var/backups

Configure Archiving

Cisco IOS-XE

Some special characters will cause a silent failure if used in the password. If you encounter this, try escaping those characters with a backslash.

archive
 path scp://<username>:<password>@<server>/<path>/
 maximum 14
 time-period 10080
 write-memory
 log config
  logging enable
  logging size 200
  hidekeys
  notify syslog
  exit
 exit