I want to allow a SFTP limited user to access and change scripts in specific root directory called /root/scripts with SSH access disabled. I am having a hard time finding any solutions.

The main server is executing these scripts so directory must stay in root folder.

Also setting user -s to bin/nologin or bin/false disables somehow sftp access too, nothing happens when tries to login. EDIT: using shell /usr/lib/openssh/sftp-server works ideal.

Current situation:

in /etc/ssh/sshd_config


Subsystem sftp internal-sftp
Match User specops
ChrootDirectory /root/scripts
AllowTCPForwarding no
X11Forwarding no

ForceCommand internal-sftp

Also this is executed:

chown specops "/root/scripts"
usermod -d "/root/scripts" specops

Now connecting with specops I find myself in /.. directory without any directories listed

Running Debian 6 E.G user specops

  • And what have you done so far? I guess you've created an sftp cage right? How did you do that, did you pointed the user to the directory you mention? – YoMismo Oct 7 '15 at 10:42
  • Updated with current detailed situation – BuFF Oct 7 '15 at 11:27
  • specops directory should be /root, not scripts. The base dir where the users start should be owned by root and only have acess to the subdirectories inside there on the other hand, usermod command is OK since the user base directory should be that. Check the next link howtoforge.com/… – YoMismo Oct 7 '15 at 11:32
  • Changed to /root. service ssh restarted. /root is chmoded 744, /scripts to 777. Still I find myself in /.. directory with specops without nothing inside. Some rights missing..? passwd: specops:x:1001:1001::/root:/usr/lib/openssh/sftp-server – BuFF Oct 7 '15 at 11:51
  • Fixed rights. At least 755 were needed. Now it's working like planned. Thank you for right direction. – BuFF Oct 7 '15 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.