Can't chroot a user [duplicate]

Question

My ssh-server has been working like a charm for 4 years now, so I just want to add a user + chroot him to a specific folder.

> useradd -m -c /home/thomas -s /bin/sh thomas
> passwd thomas
> chmod 755 /home/thomas
> chown root: /home/thomas
> service ssh restart

When I do this, I can connect through ssh and my sftp connexion works. The problem is that I want to chroot to a specific folder.

> vim /etc/ssh/sshd_config

Add at the end of the file:

Match user thomas
    ChrootDirectory /home/%u

When I only add this, this shouldn't change something right? The configuration should be the same and I still should be able to connect or use sftp... so I restart with service ssh restart and I cant connect with sftp anymore.

Just in case:

root@xx:/etc/nginx/sites-enabled# /usr/sbin/sshd -v
sshd: illegal option -- v
OpenSSH_6.0p1 Debian-4+deb7u6, OpenSSL 1.0.1t  3 May 2016
usage: sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-c host_cert_file]
            [-f config_file] [-g login_grace_time] [-h host_key_file]
            [-k key_gen_time] [-o option] [-p port] [-u len]
root@xx:/etc/nginx/sites-enabled#

What am I doing wrong?

Answer 1

The sshd_config manual states that

The ChrootDirectory must contain the necessary files and directories to support the user's session. For an interactive session this requires at least a shell, typically sh(1), and basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4), and tty(4) devices. For file transfer sessions using SFTP no additional configuration of the environment is necessary if the in-process sftp-server is used, though sessions which use logging may require /dev/log inside the chroot directory on some operating systems (see sftp-server(8) for details).

You should create the dev directory and then copy the /dev/MAKEDEV script there. Using the script, create the needed device files.

For interactive users, you need to install the necessary binaries and associated libraries in the chroot too.

The reference to "the in-process sftp-server" means ForceCommand internal-sftp should be used in your Match block.

Note: the excerpt is from OpenSSH 7.5 since I don't have access to any older SSH implementation.