I'm trying to create the user lenny, that has read and write permissions in the folder /home/lenny/ and has no shell but only access via SFTP. I'm doing the following:

useradd lenny
mkdir /home/lenny
usermod -d /home/lenny lenny
passwd lenny
chown lenny:lenny /home/lenny
chmod 755 /home/lenny
usermod -s /bin/false myuser

I then modified /etc/ssh/sshd_config:

Subsystem sftp internal-sftp`  

Match User lenny
ChrootDirectory /home/lenny
ForceCommand internal-sftp

Now when I do sftp lenny@server I can leave the CHROOT easily by doing cd / and ls -la, I see everything!

Why is that??? I don't get it, configuration should be okay, or am I wrong?

  • Probably, you should add "AllowTcpForwarding no" and "X11Forwarding no" to the "Match User" section.
    – jofel
    Apr 19 '12 at 15:41
  • @jofel I tried it with these two settings, it didn't work either. Apr 19 '12 at 17:13
  • What version of sshd are you running? The version of the ssh package is sufficient.
    – George M
    Apr 19 '12 at 17:26
  • @uther It's actually a Kubuntu 11.10 with openssh. Version is 5.8p1-7ubuntu1. Apr 19 '12 at 18:34

Did you restart the sshd service after making the changes to /etc/ssh/sshd_config?

sudo /etc/init.d/ssh restart

Ensure the chroot directory for the sftp user (in this case /home/lenny) is owned by root, not the sftp user. chmod 755 is correct.

Also, I would add the following two lines for additional security:

Match User lenny
    ChrootDirectory /home/lenny
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no

Restart your sshd service and you should have the desired chroot.

  • Yes, I did a restart and reload, didn't work. Apr 19 '12 at 17:13
  • See my additional edit. The directory should be owned by root. I missed that the first time and it was staring me in the face.
    – George M
    Apr 19 '12 at 18:56
  • Thanks, that solved it! One further question, how can I give lenny read and write permissions below /home/lenny? Apr 20 '12 at 7:44
  • 2
    So user lenny cannot upload files or create directories in /home/lenny? Make sure /home/lenny group ownership is lenny and chmod 775 /home/lenny.
    – George M
    Apr 20 '12 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.