I am trying to set up my Openssh server to allow for chrooted sftp-only users as well as for non-chrooted sftp and ssh users. My condensed (comments and blank lines removed) /etc/ssh/sshd_config looks like this:
Port 22 Protocol 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key UsePrivilegeSeparation yes KeyRegenerationInterval 3600 ServerKeyBits 768 SyslogFacility AUTH LogLevel INFO LoginGraceTime 120 PermitRootLogin yes StrictModes yes RSAAuthentication yes PubkeyAuthentication yes IgnoreRhosts yes RhostsRSAAuthentication no HostbasedAuthentication no PermitEmptyPasswords no ChallengeResponseAuthentication no X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes AcceptEnv LANG LC_* #Subsystem sftp /usr/lib/openssh/sftp-server Subsystem sftp intenal-sftp UsePAM yes Match Group sftpusers ChrootDirectory /var/sftp/%u ForceCommand internal-sftp
What I have achieved by this:
- Users in the sftupsers group can sftp their files into their directories, but can't log in. Check.
- Users, who are not in sftpusers can login via ssh. Check.
- Users, who are not in sfttpusers can not sftp files. Oops.
If I change the
Subsystem sftp-line to the commented out version, the "privileged" users can sftp and ssh, but the chrooted users can no longer sftp.
With the above config-file I get the error message
Connection closed by server with exitcode 127 from FileZilla and
Fatal: Received unexpected end-of-file from SFTP server from psftp.
Any idea how to fix this?