Everything I am reading says that for chroot to work with sftp root has to own the folder. I want to make it so a user can only sftp to a sub-directory in their home folder like /home/user/some/folder. Obviously ro

  • What is the (real or perceived) problem w/ root owning the directory? – tink Dec 23 '18 at 1:09
  • If I set up sshd_config to enforce sftp to %h/shared, I want each account to be able to manage that folder when/if they are on the box instead of depending on root to change ownership and what not. – IMTheNachoMan Dec 23 '18 at 1:33

man 8 sftp-server, see:

-d start_directory
         specifies an alternate starting directory for users.  The
         pathname may contain the following tokens that are expanded at
         runtime: %% is replaced by a literal '%', %d is replaced by the
         home directory of the user being authenticated, and %u is
         replaced by the username of that user.  The default is to use the
         user's home directory.  This option is useful in conjunction with
         the sshd_config(5) ChrootDirectory option.
  • That still lets them navigate to other directories outside of that path. – IMTheNachoMan Jan 15 at 0:47
  • And? If you define right permissions on files and directories, what is the problem? The whole request is silly, if there is $HOME of the user, why she cannot see her files? The request is trying to solve a problem which should not exist in right design. Maybe you need another application, sftp is UNIX tool and let you modify files on filesystem. – Jiri B Jan 15 at 6:14
  • In my setup/use-case, I can't enforce what permissions a user sets for their files/folders but I still need to be able to prevent one user from seeing files/folders of another user. – IMTheNachoMan Jan 15 at 11:55
  • Well, your original question is incomplete then. Let me guess. Do you want each user has visible/writtable only her files in their $HOME but you want to make them collaborate in a folder? Am I right? If so then shared folder cannot be inside any HOME dir and users should not use shared account or to login into other user HOME. Then make a dir layout like this: /groupA/shared, /groupA/userX, /groupA/userY and chroot them into /groupA and use -d for sftp-server to change working dir after login to /groupA/<user>/. For stupid users you can create symlink for /groupA/<user>/shared in HOME. – Jiri B Jan 15 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.