I followed multiple guides on the internet on how to restrict a user so that he cannot change/see files outside of his home directory.

So I created a user, let's call him john and I also created a group called sftp which is his primary group. I also updated his home directory to the directory I'd like him to be jailed to. (In that case /var/www/) Then I added some configuration lines to /etc/ssh/sshd_config

Match Group sftp
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcoForwarding no

Didn't work with this. John was able to access the directorys outside of his home directory. Then I tried to make it user specific.

Match User john
    ChrootDirectory /var/www
    ForceCommand internal-sftp
    AllowTCPForwarding no
    X11Forwarding no

Didn't work either and john could access still all files. So I even tried to use both configurations but none worked.

Johns shell is /bin/bash although it was mentioned in some guides to set it to /bin/false or /bin/nologin but of course then I cannot connect with Filezilla for instance.

The distribution is Ubuntu 14.04.

  • Untrusted users should not have write permissions outside their home directory, but why do you care about them being able to read ("access" is unclear, since it could mean any combination of "read", "write" or "execute") files which are not security critical? As you say, they will need read and execute permissions on the shell to be able to connect with FileZilla, and the shell will need to have access to libraries and probably temporary directories to start. – l0b0 Sep 24 '14 at 12:12
  • Did you restart sshd after changing sshd_config? – Kenster Sep 24 '14 at 12:13
  • "Didn't work" is unclear. If you got an error message, please include it and all the commands leading up to it. If something didn't do what you expected it to do, please let us know what you did, what the result was, and what you believe the result should be. – l0b0 Sep 24 '14 at 12:14
  • @I0b0 The problem is that there are some PHP scripts where login credentials for a mysql server are stored. And I absolutly don't wont them to read that. And I did not get any error messages. – daniel7558 Sep 24 '14 at 12:59
  • @Kenster I restarted the service after editing – daniel7558 Sep 24 '14 at 13:01

Change the next line in the Match Group sftp block:

ChrootDirectory /var/www/%u

in case the directory in /var/www you have created is named after the user as the directory name, that way you will be able to use multiple users chrooted to their /var/www/user-directory.

You will also need to check permissions, /var/www/user-name directory must have root as its user and group and have 755 permissions. Inside that directory you will need to create a couple of directories or what you want (like in and out directories), those directories should have the user as owner and the group sftp as group and I would recommend 700 permissions or what you see fit. After that user should be able to log in and access the directories and won't be able to write anything in the root directory nor going up beyond the /var/www/user tree.

Setting the shell as /bin/false or /bin/nologin will only allow sftp connections which is interesting in case you only want sftp access, otherwise the user will be able to ssh to the system, which you may not want.

EDIT: By the way line AllowTcoForwarding no in block sftp is wrong modify it to the right one (AllowTcpForwarding)in case it is not just a typo here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.