Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 5 down vote favorite
2

I'm trying to create the user lenny, that has read and write permissions in the folder /home/lenny/ and has no shell but only access via SFTP. I'm doing the following:

useradd lenny
mkdir /home/lenny
usermod -d /home/lenny lenny
passwd lenny
chown lenny:lenny /home/lenny
chmod 755 /home/lenny
usermod -s /bin/false myuser

I then modified /etc/ssh/sshd_config:

Subsystem sftp internal-sftp`  

Match User lenny
ChrootDirectory /home/lenny
ForceCommand internal-sftp

Now when I do sftp lenny@server I can leave the CHROOT easily by doing cd / and ls -la, I see everything!

Why is that??? I don't get it, configuration should be okay, or am I wrong?

share|improve this question
Probably, you should add "AllowTcpForwarding no" and "X11Forwarding no" to the "Match User" section. – jofel Apr 19 '12 at 15:41
@jofel I tried it with these two settings, it didn't work either. – Ian Apr 19 '12 at 17:13
What version of sshd are you running? The version of the ssh package is sufficient. – uther Apr 19 '12 at 17:26
@uther It's actually a Kubuntu 11.10 with openssh. Version is 5.8p1-7ubuntu1. – Ian Apr 19 '12 at 18:34

1 Answer

up vote 5 down vote accepted

Did you restart the sshd service after making the changes to /etc/ssh/sshd_config?

sudo /etc/init.d/ssh restart

Ensure the chroot directory for the sftp user (in this case /home/lenny) is owned by root, not the sftp user. chmod 755 is correct.

Also, I would add the following two lines for additional security:

Match User lenny
    ChrootDirectory /home/lenny
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no

Restart your sshd service and you should have the desired chroot.

share|improve this answer
Yes, I did a restart and reload, didn't work. – Ian Apr 19 '12 at 17:13
See my additional edit. The directory should be owned by root. I missed that the first time and it was staring me in the face. – uther Apr 19 '12 at 18:56
Thanks, that solved it! One further question, how can I give lenny read and write permissions below /home/lenny? – Ian Apr 20 '12 at 7:44
2  
So user lenny cannot upload files or create directories in /home/lenny? Make sure /home/lenny group ownership is lenny and chmod 775 /home/lenny. – uther Apr 20 '12 at 15:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.