My ssh-server has been working like a charm for 4 years now, so I just want to add a user + chroot him to a specific folder.

> useradd -m -c /home/thomas -s /bin/sh thomas
> passwd thomas
> chmod 755 /home/thomas
> chown root: /home/thomas
> service ssh restart

When I do this, I can connect through ssh and my sftp connexion works. The problem is that I want to chroot to a specific folder.

> vim /etc/ssh/sshd_config

Add at the end of the file:

Match user thomas
    ChrootDirectory /home/%u

When I only add this, this shouldn't change something right? The configuration should be the same and I still should be able to connect or use sftp... so I restart with service ssh restart and I cant connect with sftp anymore.

Just in case:

root@xx:/etc/nginx/sites-enabled# /usr/sbin/sshd -v
sshd: illegal option -- v
OpenSSH_6.0p1 Debian-4+deb7u6, OpenSSL 1.0.1t  3 May 2016
usage: sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-c host_cert_file]
            [-f config_file] [-g login_grace_time] [-h host_key_file]
            [-k key_gen_time] [-o option] [-p port] [-u len]

What am I doing wrong?

  • 1
    Did you read the sshd_config manual about creating some necessary /dev files in the chroot directory?
    – Kusalananda
    Apr 9, 2017 at 9:47
  • No.. what is it about? May I ask you a link? Apr 9, 2017 at 9:59

1 Answer 1


The sshd_config manual states that

The ChrootDirectory must contain the necessary files and directories to support the user's session. For an interactive session this requires at least a shell, typically sh(1), and basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4), and tty(4) devices. For file transfer sessions using SFTP no additional configuration of the environment is necessary if the in-process sftp-server is used, though sessions which use logging may require /dev/log inside the chroot directory on some operating systems (see sftp-server(8) for details).

You should create the dev directory and then copy the /dev/MAKEDEV script there. Using the script, create the needed device files.

For interactive users, you need to install the necessary binaries and associated libraries in the chroot too.

The reference to "the in-process sftp-server" means ForceCommand internal-sftp should be used in your Match block.

Note: the excerpt is from OpenSSH 7.5 since I don't have access to any older SSH implementation.

  • MAKEDEV should be launched as root or as the user itself (= thomas in my case)? Apr 9, 2017 at 10:12
  • @OlivierPons As root.
    – Kusalananda
    Apr 9, 2017 at 10:13
  • From where? /home/thomas and inside (/home/thomas/dev/): both didn't create null, zero, stdin and stdout etc nodes. Apr 9, 2017 at 10:16
  • I can connect through ssh, it's ch-rooted, but I cant connect through sftp (which is my primary goal). Any suggestion? Apr 9, 2017 at 10:19
  • Update the question with the output form sftp -vvv .... It's hard to debug blindfolded.
    – Kusalananda
    Apr 9, 2017 at 10:23

Not the answer you're looking for? Browse other questions tagged .