5

If a user logs into a machine via SFTP, one can make use of ChrootDirectory keyword to give an illusion that user is in a root directory. But that directory is only writable by root user. I would love for this user to have such write capabilities, and it doesn't appear that OpenSSH offers this, unless I missed something?

I am aware that that SFTP user can be given write access to any file/directory inside that ChrootDirectory, but it's not good enough. I want the user to also create/delete the files directly under that "root" directory, without the workaround of creating a subdirectory that that user has write access to.

1 Answer 1

0

I ran into the same problem with my in-house SFTP. What I did to get around this is:

Inside your sshd_config file:

Match group     sftpusers
  ChrootDirectory %h

Inside your /etc/groups file, add your sftp user to the sftpusers group (create it if it doesn't exist):

sftpusers:x:6000:user1,user2

For the ChrootDirectory, make sure you chown the directory to the following (warning be-careful of the directory that you are running this command on, make sure it is being run only on the directory that the user logs into, the -R commend means recursive, so if there are subfolder you do not wish this to command to include, remove it. Also a SFTP user should never be given access to a root level system directory like /etc, best to make a folder under something like /usr/local/alcatraz and give them access to that):

chown -R root:sftpusers userChrootDirectory

Chmod the directory to have the permission you desire, something like:

drwxrws---

If you require more information, let me know, this is just the highlights, that should get you to where you want to be.

2
  • 2
    For openssh this method (adding group write permissions to the chroot directory) will not work. Quoted from the openssh (at least version 7.2) sshd_config(5) man page: "At session startup sshd(8) checks that all components of the pathname are root-owned directories which are not writable by any other user or group."
    – Juan
    Nov 28, 2017 at 21:12
  • ChrootDirectory %h suggests you want to use the user's (e.g. user1's) home directory (e.g. /home/user1) as chroot target, but that's not possible because that directory is owned by the user (e.g. user1) whereas the OpenSSH requirement is that it must be owned by root. Also, you cannot make it writeable by giving group write permissions because OpenSSH also does not allow that.
    – Frans
    Mar 14 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.