Allow user to connect using SSH or SFTP but limit to home dir (Centos7)

Question

I'm configuring a web server which should have multiple domains & users.
I'm trying to limit users only to their home dir & allow them to connect with SSH or SFTP.
So far I followed some guides & managed to restrict the user to a specific directory & connect with SFTP, but when I try to connect using SSH I get:

Could not chdir to home directory /home/username: No such file or directory /bin/bash: No such file or directory

My end of /etc/ssh/sshd_config looks like this:

Subsystem sftp internal-sftp

Match Group sftp
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp

*I added the user 'username' to group 'sftp'.
*If I comment the "Match Group ..." Block & change "Subsystem sftp internal-sftp" back to "Subsystem sftp /usr/libexec/openssh/sftp-server" I can connect with SSH, but I have no folder restriction.

-- Any idea?

---

Sub question: I also mounted the domain from the /var/www/ dir to the user home dir to make it accessible, is that how it's usually done on shared hosting?

---

Answer 1

You need to set up correct chrooted environment per each user you want to let in via SSH.

Each chrooted home dir would have to have its own minimal set of Unix executables and device files to be able to launch the shell etc. The command set would be limited to whichever commands you copy into user's "own root". This is the main trickiness of chrooted environments -- users will endlessly complain that a particular command is missing.

There's a bunch of manuals on how to set up chrooted SSH, this one looks sane: Chrooted SSH/SFTP Tutorial (Debian Lenny).

Cheers!