Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a simple way to restrict an SCP/SFTP user to a directory? All methods that I've come across require me to set a chroot jail up by copying binaries, but I don't think that should be necessary.

share|improve this question

SSH Supports chrooting an SFTP user natively. You just need to supply


In your sshd config file, and restart sshd.

If you are just doing sftp, then you don't have to do anything more. Unfortunately, this doesn't work for scp. For interactive shell, you will need to copy binaries, and /dev nodes into the chroot.

An example config, for just a single user, testuser:

Match User testuser
    ChrootDirectory /home/testuser
    ForceCommand internal-sftp

A few things to be aware of, from the sshd_config man page:

    All components of the pathname must be root-owned directories that are not
    writable by any other user or group.  After the chroot, sshd(8) changes the
    working directory to the user's home directory.

Search for ChrootDirectory in man sshd_config for more information.

share|improve this answer
Note that the part that starts with "Match User testuser" must be at the END of the file, as it will include configuration lines only if the user is "testuser" from that point on. – Magnus Oct 5 '12 at 14:10
Is it also possible to Chroot only for the SFTP Protocol, but to still allow normal SCP connections? – lanoxx Mar 22 '13 at 15:16
On my Ubuntu 14.04 machine, it was also necessary to change the Subsystem sftp /usr/lib/openssh/sftp-server line to Subsystem sftp internal-sftp -f AUTH -l VERBOSE – partofthething Sep 23 '15 at 1:41
@Magnus or until another Match section. – roaima Jan 10 at 17:21

A chroot is a reasonably simple method. Since the operating system already has this security feature, daemon writers tend not to attempt to reimplement it.

Rssh comes with a guide on setting up a chroot jail. It's in the CHROOT file in the source distribution. In a nutshell, you need to have:

  • A few binaries, copied from the root: /usr/bin/scp, /usr/libexec/openssh/sftp-server, /usr/bin/rssh_chroot_helper
  • The libraries ({/usr,}/lib/lib*.so.[0-9]) that they use, likewise copied
  • A /etc/passwd (quite possibly not a copy but derived from the master)
  • A few devices: /dev/null, /dev/tty, and also a /dev/log socket for logging (and you need to tell your syslog daemon to listen on that socket)

Extra tip that isn't in the rssh documentation: If you need some files to be accessible in a chroot jail, you can use bindfs or Linux's mount --bind to make additional directory hierarchies from outside the jail. bindfs allows the remounted directory to have more restrictive permissions, for example read-only. (mount --bind doesn't unless you apply a kernel patch; Debian has included this patch since at east lenny but most other distributions haven't as of 2011.)

share|improve this answer

You might want to look at scponly; it's essentially a login shell that can only be used to launch scp or the sftpd subsystem. In the scponlyc variant it performs a chroot before activating the subsystem in question.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.