Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Possible Duplicate:
Restricting an SSH/SCP/SFTP user to a directory

Can I confine my users to their /home/%u directory using simply open-ssh configuration? I did the following from what I found on the Internet Stopped the server To the sshd_config file appended the following

Match group sftpusers
    ChrootDirectory /home/%u
    X11Forwarding no
    AllowTcpForwarding no

started the server

FYI I have the users added to sftpusers group

My users can still access entire file structure on my system

Ubuntu Server 12.04 LTS with open-ssh installed

share|improve this question
add comment

marked as duplicate by Gilles, Renan, jasonwryan, phunehehe, warl0ck Oct 5 '12 at 12:42

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

You also need to use Subsystem sftp internal-sftp. Forbid all the other forwardings, and ForceCommand internal-sftp.

Also, as said in sshd_config man page, the directory to chroot into must be owned by root and not writable by anybody, which probably is not the case for your /home/%u.

Probably, you'd want:

sudo mkdir -p /jail/home
sudo mount --bind /home /jail/home

and have

ChrootDirectory /jail

Or to restrict users to their own directory, you'd need a bind-mount for each user:

cd /home
for u in */ do
  sudo mkdir -p "/jail/$u/home/$u"
  sudo mount --bind "$u" "/jail/$u/home/$u"
done

And have

ChrootDirectory /jail/%u
share|improve this answer
    
Thanks sch!! I will try this and update accordingly –  Vikram Oct 5 '12 at 13:32
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.