2

I have a problem with chroot sftp an their home folder. I would like to write in user's home but I don't have proper permission for doing that.

sshd_config

Match User demo
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

User

demo:x:1013:1014::/home/ftp/demo2:/bin/false

Directory

root@xxx:/# ls -l /home/ftp/
drwxr-xr-x  2 root root 4096 Nov  3 13:35 demo2

Error message

debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
Write failed: Broken pipe

I know that I can write into a folder under /home/ftp/demo2 but I need to write in /home/ftp/demo2 not in a inner folder, it's mandatory.

I've tried to change demo2 permissions and user/group, but it was not possible to write in it.

And.. there are other problem. I have 3 users that have their homes under /home/ftp but, on the other hand, I have some users that have their home in a different path, so I can't use ChrootDirectory /home/ftp/%u, I need to use %h

Are there any way to do this?

Thanks a lot!

  • I found out that if I change user id to 0 it works and I can write into home directory but I dont like so much this way. – jask Nov 3 '14 at 23:20
0

You can set the chroot location differently for each user like this:

Match User a
    Configuration for user a
Match User b
    Configuration for user b

OpenSSH's SFTP subsystem refuses to chroot into any directory not owned by root for security reasons, so you can't make new files right under the chroot directory unless you're root. By changing your user id to 0, you effectively became root, which is an extremely BAD idea. By becoming root, not only can your user escape the chroot jail, your user gained permission to do anything on your system, violating the principal of least privilege. I would strongly recommend that you change your user id back to normal.

If you were choosing to use chrooted SFTP for better security, I also doubt that it's an effective choice, because chroot was not designed designed for security and there are many ways known to get around it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.