I have a problem with chroot sftp an their home folder. I would like to write in user's home but I don't have proper permission for doing that.


Match User demo
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no




root@xxx:/# ls -l /home/ftp/
drwxr-xr-x  2 root root 4096 Nov  3 13:35 demo2

Error message

debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
Write failed: Broken pipe

I know that I can write into a folder under /home/ftp/demo2 but I need to write in /home/ftp/demo2 not in a inner folder, it's mandatory.

I've tried to change demo2 permissions and user/group, but it was not possible to write in it.

And.. there are other problem. I have 3 users that have their homes under /home/ftp but, on the other hand, I have some users that have their home in a different path, so I can't use ChrootDirectory /home/ftp/%u, I need to use %h

Are there any way to do this?

Thanks a lot!

  • I found out that if I change user id to 0 it works and I can write into home directory but I dont like so much this way.
    – jask
    Commented Nov 3, 2014 at 23:20

1 Answer 1


You can set the chroot location differently for each user like this:

Match User a
    Configuration for user a
Match User b
    Configuration for user b

OpenSSH's SFTP subsystem refuses to chroot into any directory not owned by root for security reasons, so you can't make new files right under the chroot directory unless you're root. By changing your user id to 0, you effectively became root, which is an extremely BAD idea. By becoming root, not only can your user escape the chroot jail, your user gained permission to do anything on your system, violating the principal of least privilege. I would strongly recommend that you change your user id back to normal.

If you were choosing to use chrooted SFTP for better security, I also doubt that it's an effective choice, because chroot was not designed designed for security and there are many ways known to get around it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .