I am creating a SFTP server with Chroot Jail. The problem is user cannot log into the home directory. I need to keep ChrootDirectory value to one directory above the user's home directory (/home/jail/home in this case). I read that the directory needs to be owned by root. In that case user cannot do anything except logging into the server. Below is the sftp-specific part of my sshd_config file

Match User ftpuser
    ChrootDirectory /home/jail/home/ftpuser
    ForceCommand internal-sftp

Output of $id ftpuser is

uid=1001(ftpuser) gid=1002(ftpuser) groups=1002(ftpuser),0(root)

I have intentionally added it to the root group so that ftpuser can at least login.

Output of $grep ftpuser /etc/passwd is


Permissions of /home/jail/home/ftpuser ared

rwx------+ 3 root root 4096 2011-12-12 12:49 /home/jail/home/ftpuser/

What should I do?

1 Answer 1


Well after some Google-ing I found a solution. Though it's not a good practice but it did help me.

I changed the UID of chrooted users to 0 i.e. UID of root user, without changing the login shell. As a result chrooted user can access its home directory the way I need him to. And since the login shell is /bin/false he can't log into the system like other users (I actually tried doing su - ftpuser while I was logged into my machine as root and ftpuser didn't get the shell access).

Though this solution might not be good or preferable, it was the only workaround I could find.

  • Changing the UID to 0 defeats any security that the chroot may bring. Chroot in itself doesn't provide security, all it does is prevent unprivileged chrooted users from directly accessing the filesystem outside the chroot. Dec 12, 2011 at 23:18
  • @Gilles - I needed the user to log into /home/jail/home/username. But with chrooting I wasn't able to let it log in anywhere beyond /home/jail/home. I understand that the solution I posted is not good. But I couldn't find any other solution.
    – Dharmit
    Dec 13, 2011 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .