I'm trying to create an sshkey to send to a vendor so they can connect to their chrooted jailed folder: /home/jail/home/ The folder setup and permissions are all set to that specific user, lets say "user1" user1:user1

Whenever I create a key with ssh-keygen, it always lists the root user at the bottom of the .pub as root@system. I don't want the vendor connecting as root, rather have them connect as user1 so they only have access to their chrooted directory. The user accounts do not have login creds as I only want them to login with sshkeys so they can sftp their data to the drop folder.

I can't create the key on the user1 account as its privileges are very minimal and they can't even run ssh-keygen. Everything else I'm trying just set it to root@system since that's the account I'm logged in as. This has to be a common practice but I can't figure this out. I was assuming that I would put the .pub of the pair in the chrooted authorized_hosts file and then securely send them the private key to use to connect via SFTP and drop off their files.

Everything works properly if I try to sftp using: sftp -i file [email protected]. However, I can also just do sftp -i file [email protected] and it lets me in there with root permissions. I just need to stop the vendor from being able to just use root as the username and bypass the chroot.

1 Answer 1


Anything after the actual public key itself in the .pub file is actually just a comment; it usually defaults to username@hostname for the user who created the key and the host on which it was created. It can be removed entirely or replaced with a comment indicating its role as a jailed single-user key:

ssh-rsa [HASH GOES HERE] root@myhost

could be:

ssh-rsa [HASH GOES HERE] Special keypair jailed shell access

This can be done at creation with the -C switch. Quoth man ssh-keygen:

 -C comment
         Provides a new comment.

So, if I were to ssh-keygen -C "This is a comment", the public key would appear as:

ssh-rsa [HASH] This is a comment
  • Good to know! I started to think that for a bit a moment ago and tried to just add the .pubkey in to the auth_keys in the user1 jailed directory. When I tried to SSH in using the identity file and [email protected] is put me in the right place and I was jailed. However, when I tried to do the same thing as [email protected] it let me in as root. Is there anyway that I can only allow user1 to use that key... or, make it so that key only allows someone to that specific directory?
    – saleetzo
    Commented Mar 29, 2017 at 20:43
  • Easy enough -- don't have that key listed in root's authorized_keys file?
    – DopeGhoti
    Commented Mar 29, 2017 at 20:45
  • The .pub for user1 is not listed in the /root/.ssh/authorized_keys file -- that one is totally blank.
    – saleetzo
    Commented Mar 29, 2017 at 20:51
  • All is good now in this town!!! Long days and short nights make the mind get nutty -- i had another term open that was logged in as root... that is why i was authing through it. Thanks @DopeGhoti
    – saleetzo
    Commented Mar 29, 2017 at 22:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .