Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Can I confine my users to their /home/%u directory using only OpenSSH configuration? From instructions I found on the Internet, I stopped the SSH server and appended the following to the sshd_config file:

Match group sftpusers
    ChrootDirectory /home/%u
    X11Forwarding no
    AllowTcpForwarding no

I then started the SSH server again.

FYI I have the users added to sftpusers group

My users can still browse i.e cd / and are able to use cat command to list file content (cat /usr/bin/test.sh) in entire file structure on my system

I'm running Ubuntu Server 12.04 LTS.

share|improve this question
    
server logs and/or client verbose connection might give more info? –  Karthik T Oct 31 '12 at 11:06
    
What are the perms on your home dir? For chroot to work with SSH the home dir must be root owned and 755 perm. Check auth.log for some clues. –  didster Oct 31 '12 at 11:24
    
Client Logs ------------------------------- ssh user4@192.168.1.2 user4@192.168.1.2's password: Last login: Wed Oct 31 21:37:39 2012 from mylap.local user4@mahesh:~$ cd / user4@mahesh:/$ ls /home/user2/ 1.log examples.desktop user4@mahesh:/$ ___________________________________ Server configuration is same as mentioned above .(i don't how to attach a file in this site,pls suggest if you know) /home/ directory permissions have 755 –  Maheshwar Oct 31 '12 at 18:20

1 Answer 1

First of all, I would suggest using ChrootDirectory %h instead of /home/%u, as %h expands to the user's home, even if it's no /home/$USER.

Now to your actual problem: you need to force internal-sftp as the command to be run. The following config works just fine for me, and should also for you:

Match group sftp
    ForceCommand internal-sftp
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no

The user's home should be root-owned and have 755 permisions as mentioned above:

drwxr-xr-x 22 root root 4.0K Nov 24  2011 /home/testuser
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.