Does OpenSSH_5.9p1 support Chrooted SSH?

Question

Lately i upgraded my SSH server with OpenSSH_5.9p1 and tried to setup chrooted SFTP/SSH. So far i managed to setup chrooted access only for SFTP using new feature of openssh5.9p1:

Match User testuser ChrootDirectory /home/testuser X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp

But i need to enable SSH access as well for the same user. I followed many articles,and with this one http://www.howtoforge.com/chroot_ssh_sftp_fedora7 i managed to connect via SSH. But chroot seems not working, i still can browse outside folders.

Any suggestion please ?

Thanks.

Answer 1

Subsystem sftp internal-sftp -f LOCAL5 -l VERBOSE
Match Group sftp
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no

Save this and return to the command line. Restart the sshd daemon for the changes to take effect with: service sshd restart

This basically tells OpenSSH that all users in the sftp group (which we will create in a moment) are to be chrooted to their home directory (which the %h represents in the ChrootDirectory command) and forces the use of the internal-sftp helper and disables TCP port forwarding.

The Subsystem command is required to enable the use of the SFTP subsystem. This can either be a path to the sftp-server helper which is present in Fedora, or the internal-sftp, which we’ll use instead. The internal-sftp command apparently works better and doesn’t require a shell or extra libraries installed in the chroot location. I’ll not be covering chrooted command shells just yet because it’s damned difficult to make it usefully functional and I’ve not looked into it yet :-)

Next we’ll need to create the sftp group which we’ll add the users on our system that we want to confine to a jail. Do that with: -