-1

I create users who each have their own home directory, normal.

Currently I create my user as follows:

adduser -d / home / ftp / myUser myUser

My users need to connect to SFTP (open ssh installed on my vps), and I need that when my users connect in SFTP, I need the home directory to be considered as his root folder

Why ? another application is connecting to this SFTP, and if it is not considered in its root directory, the application can not send or read the files.

How can I do that?

  • "I need to create users who will only be able to access their directory, the user should not see the other directories.". Since you write that you are "new to the administration of a Linux server" I need to ask if you really need to do this, or is it acceptable simply to say that users must not be able to see into each others' directories? – roaima Nov 8 '18 at 9:53
  • @roaima Yes i really need. An other software connec via sftp and if it is not root folder of user, it does not works – user1450740 Nov 8 '18 at 9:54
  • @roaima I think yes – user1450740 Nov 8 '18 at 9:58
  • @roaima it's done – user1450740 Nov 8 '18 at 10:07
  • 1
    See ChrootDirectory in the sshd_config manual. – Kusalananda Nov 8 '18 at 10:14
2

Add or change /etc/ssh/sshd_config to include the following lines

Subsystem sftp internal-sftp

Match Group sftpusers
        ChrootDirectory %h
        ForceCommand internal-sftp

And then add all the set of your constrained users to the sftpusers group.

Finally, change ownership of the target directories to be root, and remove group/other write permission, and restart the ssh server. This is necessary for the chroot to become effective. The downside is that the user will not be able to write any files into their home directory. (You will have to create subdirectories for them to write into.)

It's not an ideal situation from a user's perspective and you may find it better to create a directory elsewhere in the filesystem for SFTP to use (eg /home/sftp/$USER) that can be locked down independently from their real home directory using ChrootDirectory /home/sftp/%u).

When you have problems (and you probably will the first during few attempts to get this right), remember to read /var/log/auth.log to see what went wrong.

  • Thanks !! I forgot to change ownership to root !! It works – user1450740 Nov 8 '18 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.