My ssh-server has been working like a charm for 4 years now, so I just want to add a user + chroot him to a specific folder.

> useradd -m -c /home/thomas -s /bin/sh thomas
> passwd thomas
> chmod 755 /home/thomas
> chown root: /home/thomas
> service ssh restart

When I do this, I can connect through ssh and my sftp connexion works. The problem is that I want to chroot to a specific folder.

> vim /etc/ssh/sshd_config

Add at the end of the file:

Match user thomas
    ChrootDirectory /home/%u

When I only add this, this shouldn't change something right? The configuration should be the same and I still should be able to connect or use sftp... so I restart with service ssh restart and I cant connect with sftp anymore.

Just in case:

root@xx:/etc/nginx/sites-enabled# /usr/sbin/sshd -v
sshd: illegal option -- v
OpenSSH_6.0p1 Debian-4+deb7u6, OpenSSL 1.0.1t  3 May 2016
usage: sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-c host_cert_file]
            [-f config_file] [-g login_grace_time] [-h host_key_file]
            [-k key_gen_time] [-o option] [-p port] [-u len]

What am I doing wrong?

  • 1
    Did you read the sshd_config manual about creating some necessary /dev files in the chroot directory? – Kusalananda Apr 9 '17 at 9:47
  • No.. what is it about? May I ask you a link? – Olivier Pons Apr 9 '17 at 9:59

The sshd_config manual states that

The ChrootDirectory must contain the necessary files and directories to support the user's session. For an interactive session this requires at least a shell, typically sh(1), and basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4), and tty(4) devices. For file transfer sessions using SFTP no additional configuration of the environment is necessary if the in-process sftp-server is used, though sessions which use logging may require /dev/log inside the chroot directory on some operating systems (see sftp-server(8) for details).

You should create the dev directory and then copy the /dev/MAKEDEV script there. Using the script, create the needed device files.

For interactive users, you need to install the necessary binaries and associated libraries in the chroot too.

The reference to "the in-process sftp-server" means ForceCommand internal-sftp should be used in your Match block.

Note: the excerpt is from OpenSSH 7.5 since I don't have access to any older SSH implementation.

| improve this answer | |
  • MAKEDEV should be launched as root or as the user itself (= thomas in my case)? – Olivier Pons Apr 9 '17 at 10:12
  • @OlivierPons As root. – Kusalananda Apr 9 '17 at 10:13
  • From where? /home/thomas and inside (/home/thomas/dev/): both didn't create null, zero, stdin and stdout etc nodes. – Olivier Pons Apr 9 '17 at 10:16
  • I can connect through ssh, it's ch-rooted, but I cant connect through sftp (which is my primary goal). Any suggestion? – Olivier Pons Apr 9 '17 at 10:19
  • Update the question with the output form sftp -vvv .... It's hard to debug blindfolded. – Kusalananda Apr 9 '17 at 10:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.