So I have this server I log on with my sudoer account via SSH using a key. I have also created another, restricted, account so that I can give another user access to SFTP files into a specific folder.

Now, when I try to connect using sftp, it´s still spitting invalid key back at me.

I would like that specific user to be able to SFTP using only username and password. Any help here is appreciated, thanks!


closed as unclear what you're asking by Jakuje, Raphael Ahrens, Jeff Schaller, Mongrel, Kusalananda Feb 4 '17 at 12:12

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Sounds like you need to modify the Authentication Methods section of your /etc/sshd_config. man sshd_config for the gory details. – fpmurphy Feb 4 '17 at 1:46
  • 1
    Without knowing how is your sshd configured, all the answers are only blind shots to the dark. – Jakuje Feb 4 '17 at 10:06

In /etc/ssh/sshd_config Define the following exception in sshd by adding this block for each user name:

Match User username
 ChrootDirectory %h
 ForceCommand internal-sftp
 PasswordAuthentication yes

If you have multiple accounts, it's easier to have a group catch:

Match Group sftp
  ChrootDirectory %h
  ForceCommand internal-sftp
  PasswordAuthentication yes

For the sake of clarity, you meant: No public key requirement. A private key stay's on the client's workstation/server.

After this, reload sshd and you're good to go. Read more about it at https://wiki.archlinux.org/index.php/SFTP_chroot


Probably the easiest and simplest solution is to create a second sshd daemon which has a different config file and so different attributes. This one can specify the ONE user that is allowed to use it and the account can be set with whatever credentials are appropriate.

I for example have a second server, invoked with:

/usr/sbin/sshd -f /etc/ssh/sshd_config1

The config1 file specifies a different port,

Port 2134
AllowUsers xxxxy yyyyx
AuthenticationMethods password
PubkeyAuthentication no

Not the answer you're looking for? Browse other questions tagged or ask your own question.