2

How can one chroot ssh users to their home directories?

This is what i have set in my sshd_config file:

ChrootDirectory %h

Subsystem       sftp    /usr/libexec/openssh/sftp-server

ssh version is 6.6.1

This is the error i get when trying to log in:

Could not chdir to home directory /home/user: No such file or directory

/bin/bash: no such file or directory
2

If you want to chroot your users to their directories, you need to have the shell & other things they would need to exec in their directories. Which is what your error saying. Chroot is changing root to /home/user, then tries to find /bin/bash (user's shell of choice) in /home/user/bin/bash, fails & reports the error.

2

The first error message ("Could not chdir...") is coming from ChrootDirectory in your sshd_config. From the documentation:

ChrootDirectory

Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.

After attempting the chroot is when the problem occurs about not being able to find bash. This is related to not having the entire chroot environment setup (see the documentation for chroot(2)).

If you want the user's interactive environment to be chroot'd (not just sftp)you have a lot of work to do. Depending on your ultimate goal, you may want to simply use a restricted shell instead (check out bash(1) and vim(1) and search for "restricted" to find some ideas of how to set things up).

I found a couple of other references to similar questions on askubuntu.com and on archlinux.org (be sure to scroll to the bottom of the second one for a description of why the directory must be root owned).

  • it is unable to find /bin/bash and thus giving the error, that much is understandable. But why is it unable to find the user home directory? All components of the pathname are root owned and not writable by any other user or group. – Soban Jun 1 '15 at 9:20
  • The error is pretty explicit: someone else has write authority. If the directory is /home/username, you need to check /home/username, /home, and /, to ensure that all are owned by root and all permissions are go-w. – Azhrei Jun 2 '15 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.