In order to make a file server with restricted access, I set the following configuration:

On the file server (Debian Wheezy)

  • Create a user data-reader without home, without shell, in the group named data.
  • Create a directory /somewhere/share/ owned by root with a sub-directory /somewhere/share/data/ accessible by the group data.
  • Add the following configuration to /etc/sshd_config:
    Match group data
        ChrootDirectory /somewhere/share
        ForcedCommand internal-sftp
        X11Forwarding no
        AllowTcpForwarding no

That way, data-reader can only read files using SFTP in the directory /somewhere/share/data. Ok.

On the client (another Debian)

Use sftp data-reader@<server_ip> to connect to the server. From the SFTP console I have access in read-only to /somewhere/share/data with SFTP commands like ls or get and I cannot see other paths. Good ! that is what I wanted.

BUT there is this nice command listed with help:

!    Escape to local shell

And if I run

!ls / 

I can actually see all the files from / on the server ! I can see the content of any file. But I don’t want that, I want the user not to be able to get out of his directory.

Is there a way to restrict access of this "escape" command ?

Thank you for your help.


Escaping to a local shell means just that -- the user now has a shell on the client, not on the server. Touch a file in /tmp on both systems (named differently!) to see the difference.

| improve this answer | |
  • Aaaaand now I feel dumb. Thank you I should have checked that before ! – RomainTT Jul 9 '19 at 19:07
  • Believe me, it's easy to get turned around with terminology and systems; keeping your feet on the ground (and asking good, clear questions!) helps. Glad your surprise was on the innocuous side! – Jeff Schaller Jul 9 '19 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.