I'm trying to restrict all users of a certain group to their home directory. They should be able to SFTP to the directory and read/write whatever they like within there.
I have implemented the usual solution found in all tutorials:
Subsystem sftp internal-sftp Match Group users ChrootDirectory %h AllowTCPForwarding no X11Forwarding no ForceCommand internal-sftp
# service ssh restart
The only way this works is if their home directory is owned by root.
But if it's owned by root, the user can't transfer/modify files to the directory (so what's the point?).
If I change the owner to the user, they can no longer connect to the server via SFTP.
How to solve this problem?
The user should be able to SFTP to their home directory and do whatever they want within it.