2

Ubuntu 14.04

I'm trying to restrict all users of a certain group to their home directory. They should be able to SFTP to the directory and read/write whatever they like within there.

I have implemented the usual solution found in all tutorials:

/etc/ssh/sshd_config

Subsystem sftp internal-sftp
Match Group users
  ChrootDirectory %h
  AllowTCPForwarding no
  X11Forwarding no
  ForceCommand internal-sftp

Restarted SSH

# service ssh restart
  • The only way this works is if their home directory is owned by root.

  • But if it's owned by root, the user can't transfer/modify files to the directory (so what's the point?).

  • If I change the owner to the user, they can no longer connect to the server via SFTP.

How to solve this problem?

The user should be able to SFTP to their home directory and do whatever they want within it.

  • 1
    If their group has full permissions for their home directory it might work e.g. chown root:users /home/myuser; chmod 770 /home/myuser – gogoud Nov 25 '15 at 12:17
  • agreed: the permissions for the chroot (in particular dev and bin directories) has to be restricted, but home-directories under the chroot can be whatever makes sense. – Thomas Dickey Nov 25 '15 at 12:19
  • @gogoud I tried that, it doesn't work. User still can't connect on SFTP. – BadHorsie Nov 25 '15 at 12:24
  • Replace ChrootDirectory %h by ChrootDirectory /home/%u A good HOWTO Jail SFTP – user144775 Nov 25 '15 at 12:59
1

I have solved this one way by creating a further sub directory in the user's home directory, which is owned by them. The home directory itself is still owned by root.

So the user can do whatever they like in their subdirectory.

  • And, can root still access the entire server? – Bob Brunius Jan 24 at 18:03
  • @BobBrunius Yes – BadHorsie Jan 30 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.