Limit user to chrooted SFTP access

If you would like to give a user sftp only access and have him chrooted in his own home dir, this is what does the trick:

This has been tested on an Ubuntu 12.04 LTS system.

Add the user as you normally would. Then you need to change the users default shell

# usermod -s /usr/lib/sftp-server
# echo ‚/usr/lib/sftp-server‘ >> /etc/shells

For security reasons the root jail needs to be owned by root itself with the correct mode. Otherwise it will not work and errors get thrown in auth.log.

# chown root:root /home/username
# chmod 755 /home/username

if you want the chrooted user to have write access – which is impossible in the root jail itself you need to create a dropbox

# mkdir /home/username/dropbox
# chown username:usergroup /home/username/dropbox
# chmod 755 /home/username/dropbox

Chrooting and limiting to SFTP

Edit /etc/ssh/sshd_config

Match user username
#Match group groupname
ChrootDirectory %h
ForceCommand internal-sftp
AllowTCPForwarding no
X11Forwarding no

then issue

# sshd -t
# service sshd restart

Schreibe einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

Diese Website verwendet Akismet, um Spam zu reduzieren. Erfahre mehr darüber, wie deine Kommentardaten verarbeitet werden.