1

I'm configuring a web server which should have multiple domains & users.
I'm trying to limit users only to their home dir & allow them to connect with SSH or SFTP.
So far I followed some guides & managed to restrict the user to a specific directory & connect with SFTP, but when I try to connect using SSH I get:

Could not chdir to home directory /home/username: No such file or directory /bin/bash: No such file or directory

My end of /etc/ssh/sshd_config looks like this:

Subsystem sftp internal-sftp

Match Group sftp
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp

*I added the user 'username' to group 'sftp'.
*If I comment the "Match Group ..." Block & change "Subsystem sftp internal-sftp" back to "Subsystem sftp /usr/libexec/openssh/sftp-server" I can connect with SSH, but I have no folder restriction.

-- Any idea?


Sub question: I also mounted the domain from the /var/www/ dir to the user home dir to make it accessible, is that how it's usually done on shared hosting?

2

You need to set up correct chrooted environment per each user you want to let in via SSH.

Each chrooted home dir would have to have its own minimal set of Unix executables and device files to be able to launch the shell etc. The command set would be limited to whichever commands you copy into user's "own root". This is the main trickiness of chrooted environments -- users will endlessly complain that a particular command is missing.

There's a bunch of manuals on how to set up chrooted SSH, this one looks sane: Chrooted SSH/SFTP Tutorial (Debian Lenny).

Cheers!

  • Hi, Thanks for the answer & the attached guide. I followed it & it almost solved the issue for me. The only problem left (that I know of) is that when I ssh into the limited user account I get this error message: "Could not chdir to home directory /home/home/username: Permission denied -bash: /home/home/username/.bash_profile: Permission denied". When I tried to change the permissions of /home/home/username the error was gone but I couldn't run "ls" or other commands – Pini Jul 6 '17 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.