6

I have a linode and I access via ssh throw terminal. I need to create an sftp user which his default directory (and the only he can access) is /var/www/xxxxxx.com/public_html/directory

Now, I did it, but when I try to connect I get broken pipe or connection rejected by peer

What I did is this:

$ adduser --home /var/www/xxxxxx.com/public_html/directory/ username
$ chown username:username /var/www/xxxxxx.com/public_html/directory/
$ chmod 755 /var/www/xxxxxx.com/public_html/directory/
$ nano /etc/ssh/sshd_config

In /etc/ssh/sshd_config I added the following lines

Match User username
   ChrootDirectory /var/www/xxxxxx.com/public_html/directory/
   AllowTCPForwarding no
   X11Forwarding no
   ForceCommand internal-sftp

What am I doing wrong?

EDIT: This is the actual error

enter image description here

EDIT2: this is the error in filezilla

enter image description here

EDIT 3: auth.log

 Oct 15 17:47:11 (none) sshd[361]: fatal: bad ownership or modes for chroot directory "/var/www/xxxxxxxxxxxx.com/public_html/extras_html"
2
  • Edit your question and show us the actual error you get.
    – X Tian
    Oct 15, 2015 at 17:40
  • Ok, i did it right now
    – alfreedom
    Oct 15, 2015 at 17:45

2 Answers 2

3

This was answered many times, but I can't find it now. The answer is RTFM.

Short story long: From man sshd_config you can get this line:

ChrootDirectory

Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.

Which provides explanation for your error message. Fixing the ACLs on the path will solve your issue.

2
  • 1
    You should mention CVE-2009-2904 and/or this email message to explain why that restriction exists.
    – derobert
    Oct 15, 2015 at 18:20
  • @derobert Yes, thanks for mentioning it. But this is the long story much longer :)
    – Jakuje
    Oct 15, 2015 at 18:37
2

I solved it. The problem was because I did this:

$ chown user:user /var/www/xxxxxx.com/public_html/directory/

What I had to do is this:

$chown root:root /var/www/xxxxxx.com/public_html/directory/

Then, inside "directory" I made a directory for the user with 777 permission (is not the better way but it works).

The "rejected by peer" error is because /directory must have 755 permission.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.