I am trying to set up my Openssh server to allow for chrooted sftp-only users as well as for non-chrooted sftp and ssh users. My condensed (comments and blank lines removed) /etc/ssh/sshd_config looks like this:
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 768
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
AcceptEnv LANG LC_*
#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp intenal-sftp
UsePAM yes
Match Group sftpusers
ChrootDirectory /var/sftp/%u
ForceCommand internal-sftp
What I have achieved by this:
- Users in the sftupsers group can sftp their files into their directories, but can't log in. Check.
- Users, who are not in sftpusers can login via ssh. Check.
- Users, who are not in sfttpusers can not sftp files. Oops.
If I change the Subsystem sftp
-line to the commented out version, the "privileged" users can sftp and ssh, but the chrooted users can no longer sftp.
With the above config-file I get the error message Connection closed by server with exitcode 127
from FileZilla and Fatal: Received unexpected end-of-file from SFTP server
from psftp.
Any idea how to fix this?