In order to make a file server with restricted access, I set the following configuration:

On the file server (Debian Wheezy)

  • Create a user data-reader without home, without shell, in the group named data.
  • Create a directory /somewhere/share/ owned by root with a sub-directory /somewhere/share/data/ accessible by the group data.
  • Add the following configuration to /etc/sshd_config:
    Match group data
        ChrootDirectory /somewhere/share
        ForcedCommand internal-sftp
        X11Forwarding no
        AllowTcpForwarding no

That way, data-reader can only read files using SFTP in the directory /somewhere/share/data. Ok.

On the client (another Debian)

Use sftp data-reader@<server_ip> to connect to the server. From the SFTP console I have access in read-only to /somewhere/share/data with SFTP commands like ls or get and I cannot see other paths. Good ! that is what I wanted.

BUT there is this nice command listed with help:

!    Escape to local shell

And if I run

!ls / 

I can actually see all the files from / on the server ! I can see the content of any file. But I don’t want that, I want the user not to be able to get out of his directory.

Is there a way to restrict access of this "escape" command ?

Thank you for your help.


1 Answer 1


Escaping to a local shell means just that -- the user now has a shell on the client, not on the server. Touch a file in /tmp on both systems (named differently!) to see the difference.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .