Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Lately i upgraded my SSH server with OpenSSH_5.9p1 and tried to setup chrooted SFTP/SSH. So far i managed to setup chrooted access only for SFTP using new feature of openssh5.9p1:

Match User testuser ChrootDirectory /home/testuser X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp

But i need to enable SSH access as well for the same user. I followed many articles,and with this one http://www.howtoforge.com/chroot_ssh_sftp_fedora7 i managed to connect via SSH. But chroot seems not working, i still can browse outside folders.

Any suggestion please ?

Thanks.

share|improve this question
1  
Wrong stackexchange :) –  pst Sep 13 '11 at 9:14
    
thanks, moved to serverfault. –  taras Sep 13 '11 at 9:23
add comment

migrated from stackoverflow.com Sep 15 '11 at 7:19

This question came from our site for professional and enthusiast programmers.

1 Answer

Subsystem sftp internal-sftp -f LOCAL5 -l VERBOSE
Match Group sftp
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no

Save this and return to the command line. Restart the sshd daemon for the changes to take effect with: service sshd restart

This basically tells OpenSSH that all users in the sftp group (which we will create in a moment) are to be chrooted to their home directory (which the %h represents in the ChrootDirectory command) and forces the use of the internal-sftp helper and disables TCP port forwarding.

The Subsystem command is required to enable the use of the SFTP subsystem. This can either be a path to the sftp-server helper which is present in Fedora, or the internal-sftp, which we’ll use instead. The internal-sftp command apparently works better and doesn’t require a shell or extra libraries installed in the chroot location. I’ll not be covering chrooted command shells just yet because it’s damned difficult to make it usefully functional and I’ve not looked into it yet :-)

Next we’ll need to create the sftp group which we’ll add the users on our system that we want to confine to a jail. Do that with: -

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.