Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am creating a SFTP server with Chroot Jail. The problem is user cannot log into the home directory. I need to keep ChrootDirectory value to one directory above the user's home directory (/home/jail/home in this case). I read that the directory needs to be owned by root. In that case user cannot do anything except logging into the server. Below is the sftp-specific part of my sshd_config file

Match User ftpuser
    ChrootDirectory /home/jail/home/ftpuser
    ForceCommand internal-sftp

Output of $id ftpuser is

uid=1001(ftpuser) gid=1002(ftpuser) groups=1002(ftpuser),0(root)

I have intentionally added it to the root group so that ftpuser can at least login.

Output of $grep ftpuser /etc/passwd is

ftpuser:x:1001:1002::/home/jail/home/ftpuser:/bin/false

Permissions of /home/jail/home/ftpuser ared

rwx------+ 3 root root 4096 2011-12-12 12:49 /home/jail/home/ftpuser/

What should I do?

share|improve this question
add comment

1 Answer 1

up vote -1 down vote accepted

Well after some Google-ing I found a solution. Though it's not a good practice but it did help me.

I changed the UID of chrooted users to 0 i.e. UID of root user, without changing the login shell. As a result chrooted user can access its home directory the way I need him to. And since the login shell is /bin/false he can't log into the system like other users (I actually tried doing su - ftpuser while I was logged into my machine as root and ftpuser didn't get the shell access).

Though this solution might not be good or preferable, it was the only workaround I could find.

share|improve this answer
    
Changing the UID to 0 defeats any security that the chroot may bring. Chroot in itself doesn't provide security, all it does is prevent unprivileged chrooted users from directly accessing the filesystem outside the chroot. –  Gilles Dec 12 '11 at 23:18
    
@Gilles - I needed the user to log into /home/jail/home/username. But with chrooting I wasn't able to let it log in anywhere beyond /home/jail/home. I understand that the solution I posted is not good. But I couldn't find any other solution. –  Dharmit Dec 13 '11 at 12:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.