The way I have it set up (to teach a programming class) on a Debian system is:
First, create the user. Here's the script I use, it adds the user, creates the home directory, puts them in a a prisoner type group, copies in some default files, sets permissions and ownerships, creates sql databases, etc. Overkill for you, you can use just the first few lines.
#!/bin/bash
# $1 is username to create
# call as root@darkstar:~/ # ./script.sh username
# add the user and put them in the jailusers group, set their home
# directory so it is at http://www.example.com/username
# and set their shell to /bin/false so they can't ssh in
useradd -g jailusers -d /var/jailweb/www-example.com/$1 -s /bin/false $1
mkdir -p /var/jailweb/www-example.com/$1
# i copy some template files in for them - this is a programming class
cp /root/jailtemplate-filez/*php /var/jailweb/www-example.com/$1
# fix the ownership of them - the /var/jailweb/www-example.com has been
# chmodded as g+s so the webserver will be able to read all the files
# note that this is NOT the ideal way to deal with this, but was needed
# for my purposes
chown $1.www-data /var/jailweb/www-example.com/$1
chown $1.www-data /var/jailweb/www-example.com/$1/index.php
chmod -R 750 /var/jailweb/www-example.com/$1
# put their name on their front page
sed -i s/STUDENT/$1/g /var/jailweb/www-example.com/$1/index.php
# generate a "random" password for sftp login
salt="oh god there has to be a better way!"
lpass=`echo $1 $salt | md5sum | cut -c 5-15`
# generate a "different" "random" password
# for them to use for mysql access
mpass=`echo $1 $salt | md5sum | cut -c 13-22`
# and set it for the userlogin programmatically
echo $1:$lpass | chpasswd
# create a sql scritp file to create their mysql accounts and
# create a database for them, grant rights, etc
cat webusers-mysql_template | sed s/USERNAME/$1/g | sed s/PASS/$mpass/g >> webusersusers.sql
# put their mysql info into a php file in their web directory
cat dbinfo.php-template | sed s/USERNAME/$1/g | sed s/PASSWORD/$mpass/g > /var/jailweb/www-example.com/$1/dbinfo.php
# make sure the webserver can read it... this all SHOULD be setup for suexec
# and having each user in their own primary group... then the sticky bit, etc
# wouldn't be needed, but I'm lazy
chown $1.www-data /var/jailweb/www-example.com/$1/dbinfo.php
chmod 440 /var/jailweb/www-example.com/$1/*.php
# if there needs to be a directory the webserver can
# write to, uncomment these
#mkdir -p /var/jailweb/www-example.com/$1/writeable
#chown $1.www-data /var/jailweb/www-example.com/$1/writeable
#chmod 770 /var/jailweb/www-example.com/$1/writeable
Next, in /etc/ssh/sshd_config
be sure to uncomment the default sftp provider and add in the internal-subsystem one:
#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp
Finally also in /etc/ssh/sshd_config
add your group matching. I set a slightly different default umask
on mine -
Match Group jailusers
ChrootDirectory /var/jailweb
ForceCommand internal-sftp -u 0027
Note that I'm pointing the /
of the chroot
to the directory that contains their home directory.
Restart the ssh daemon and you should be good to go. Your users should be able to add/edit/delete stuff in their /username directory. If you want to add a shared directory, you'll need to create it and change the ownership on it