chroot directive in sshd_config fails to exclude users

Question

In Ubuntu, I have this SSH server configuration set up in /etc/ssh/sshd_config:

Subsystem sftp internal-sftp

UsePAM yes
ChrootDirectory %h
ForceCommand internal-sftp
GatewayPorts no
AllowTcpForwarding no
KeepAlive yes
IgnoreUserKnownHosts no
Match group sftp

But even users not in sftp are being restricted by chroot. For example when bobby (not in sftp) tries to SSH in, this error occurs:

sshd[17977]: fatal: bad ownership or modes for chroot directory "/home/bobby"

I have tried this:

Match group sftp, User !bobby

And restarting the service, but the same issue occurs.

Answer 1

You need Match group sftp to be before the lines you want to apply to that group. Nothing is being applied to the group sftp because there are no keywords after it! Or rather, in this case, the keywords are being applied to everyone because you don't specify a group to match until after them.

To quote from man sshd_config

Match   Introduces  a conditional block.  If all of the criteria on the
        Match line  are satisfied, the keywords on the following lines
        override those set  in the global section of the config file,
        until either another Match  line or the end of the file.  If a
        keyword appears in  multiple Match blocks that are satisified,
        only the first instance of the keyword is applied.

Try something like:

Subsystem sftp internal-sftp

UsePAM yes

GatewayPorts no
AllowTcpForwarding no
KeepAlive yes
IgnoreUserKnownHosts no

Match group sftp
  ChrootDirectory %h
  ForceCommand internal-sftp