How to restrict ssh users to browse only /home/%u contents

Question

Can I confine my users to their /home/%u directory using only OpenSSH configuration? From instructions I found on the Internet, I stopped the SSH server and appended the following to the sshd_config file:

Match group sftpusers
    ChrootDirectory /home/%u
    X11Forwarding no
    AllowTcpForwarding no

I then started the SSH server again.

FYI I have the users added to sftpusers group

My users can still browse i.e cd / and are able to use cat command to list file content (cat /usr/bin/test.sh) in entire file structure on my system

I'm running Ubuntu Server 12.04 LTS.

Answer 1

First of all, I would suggest using ChrootDirectory %h instead of /home/%u, as %h expands to the user's home, even if it's no /home/$USER.

Now to your actual problem: you need to force internal-sftp as the command to be run. The following config works just fine for me, and should also for you:

Match group sftp
    ForceCommand internal-sftp
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no

The user's home should be root-owned and have 755 permisions as mentioned above:

drwxr-xr-x 22 root root 4.0K Nov 24  2011 /home/testuser

Answer 2

Using fakechroot

1. Prepare the user and the directory you want to use for the SSH. For example, you might want to copy some commands from /bin directory into the user's bin directory. It is considered that the user's name is test and user's directory is /home/test.

2. Install fakechroot package.

   # Debian-based distros
   sudo apt install fakechroot
   

3. Open OpenSSH server configuration file for editing (e.g. /etc/ssh/sshd_config).

4. Add the following lines to the configuration file (, or replace existing lines if exist):

   # Replace test with your user of choice
   Match User test
       ForceCommand fakechroot chroot /home/test
       # Other options
   

5. Save the file. Start OpenSSH server on the specific port you want. Now, try logging in via SSH. Everything should work as expected.

Hope it helps!

Answer 3

I know this question is old but this helped me.

chmod o-x /home/*

run the above command from sudo and it will limit a user to its own home dir.