9

Can I confine my users to their /home/%u directory using only OpenSSH configuration? From instructions I found on the Internet, I stopped the SSH server and appended the following to the sshd_config file:

Match group sftpusers
    ChrootDirectory /home/%u
    X11Forwarding no
    AllowTcpForwarding no

I then started the SSH server again.

FYI I have the users added to sftpusers group

My users can still browse i.e cd / and are able to use cat command to list file content (cat /usr/bin/test.sh) in entire file structure on my system

I'm running Ubuntu Server 12.04 LTS.

Improve this question
3
  • server logs and/or client verbose connection might give more info?
    – Karthik T
    Oct 31 '12 at 11:06
  • What are the perms on your home dir? For chroot to work with SSH the home dir must be root owned and 755 perm. Check auth.log for some clues.
    – didster
    Oct 31 '12 at 11:24
  • 1
    Client Logs ------------------------------- ssh user4@192.168.1.2 user4@192.168.1.2's password: Last login: Wed Oct 31 21:37:39 2012 from mylap.local user4@mahesh:~$ cd / user4@mahesh:/$ ls /home/user2/ 1.log examples.desktop user4@mahesh:/$ ___________________________________ Server configuration is same as mentioned above .(i don't how to attach a file in this site,pls suggest if you know) /home/ directory permissions have 755
    – Maheshwar
    Oct 31 '12 at 18:20
8

First of all, I would suggest using ChrootDirectory %h instead of /home/%u, as %h expands to the user's home, even if it's no /home/$USER.

Now to your actual problem: you need to force internal-sftp as the command to be run. The following config works just fine for me, and should also for you:

Match group sftp
    ForceCommand internal-sftp
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no

The user's home should be root-owned and have 755 permisions as mentioned above:

drwxr-xr-x 22 root root 4.0K Nov 24  2011 /home/testuser
Improve this answer
1
  • 1
    Spent 3 hours yesterday. Simple and efficient solutions. Love you man!!!
    – Mohd. Umar
    Feb 7 '20 at 9:19
0

Using fakechroot

  1. Prepare the user and the directory you want to use for the SSH. For example, you might want to copy some commands from /bin directory into the user's bin directory. It is considered that the user's name is test and user's directory is /home/test.

  2. Install fakechroot package.

    # Debian-based distros
sudo apt install fakechroot

  3. Open OpenSSH server configuration file for editing (e.g. /etc/ssh/sshd_config).

  4. Add the following lines to the configuration file (, or replace existing lines if exist):

    # Replace test with your user of choice
Match User test
    ForceCommand fakechroot chroot /home/test
    # Other options

  5. Save the file. Start OpenSSH server on the specific port you want. Now, try logging in via SSH. Everything should work as expected.

Hope it helps!

Improve this answer
-1

I know this question is old but this helped me.

chmod o-x /home/*

run the above command from sudo and it will limit a user to its own home dir.

Improve this answer
2
  • 4
    It looks to me this forbid other to browse your directory, but doesn't confine you to your home dir.
    – Archemar
    May 5 '15 at 11:05
  • Yes, that's what it does.
    – scottydelta
    May 5 '15 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.