Can I confine my users to their /home/%u directory using only OpenSSH configuration? From instructions I found on the Internet, I stopped the SSH server and appended the following to the sshd_config file:

Match group sftpusers
    ChrootDirectory /home/%u
    X11Forwarding no
    AllowTcpForwarding no

I then started the SSH server again.

FYI I have the users added to sftpusers group

My users can still browse i.e cd / and are able to use cat command to list file content (cat /usr/bin/test.sh) in entire file structure on my system

I'm running Ubuntu Server 12.04 LTS.

  • server logs and/or client verbose connection might give more info? – Karthik T Oct 31 '12 at 11:06
  • What are the perms on your home dir? For chroot to work with SSH the home dir must be root owned and 755 perm. Check auth.log for some clues. – didster Oct 31 '12 at 11:24
  • 1
    Client Logs ------------------------------- ssh user4@ user4@'s password: Last login: Wed Oct 31 21:37:39 2012 from mylap.local user4@mahesh:~$ cd / user4@mahesh:/$ ls /home/user2/ 1.log examples.desktop user4@mahesh:/$ ___________________________________ Server configuration is same as mentioned above .(i don't how to attach a file in this site,pls suggest if you know) /home/ directory permissions have 755 – Maheshwar Oct 31 '12 at 18:20

First of all, I would suggest using ChrootDirectory %h instead of /home/%u, as %h expands to the user's home, even if it's no /home/$USER.

Now to your actual problem: you need to force internal-sftp as the command to be run. The following config works just fine for me, and should also for you:

Match group sftp
    ForceCommand internal-sftp
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no

The user's home should be root-owned and have 755 permisions as mentioned above:

drwxr-xr-x 22 root root 4.0K Nov 24  2011 /home/testuser

I know this question is old but this helped me.

chmod o-x /home/*

run the above command from sudo and it will limit a user to its own home dir.

  • 4
    It looks to me this forbid other to browse your directory, but doesn't confine you to your home dir. – Archemar May 5 '15 at 11:05
  • Yes, that's what it does. – scottydelta May 5 '15 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.