Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a cluster of machines (LAN) set up for password-less SSH login for running code in parallel. No problems with the SSH or functionality, however...

I'm trying to set up an sftp-only (no shell) user on the gateway machine for external (outside the cluster) file transfers to the gateway machine. I created a new group and user following the guide here (http://blog.swiftbyte.com/linux/allowing-sftp-access-while-chrooting-the-user-and-denying-shell-access/), and edited the /etc/ssh/sshd_config file as appropriate. However, when I restart the ssh server, the gateway machine is no longer accessible through SSH or SFTP. Any attempt is met with a "connection refused" message. If I switch back to the original sshd_config file, I can connect again.

Is there any known issue with setting Subsystem sftp internal-sftp that causes SSH functionality to disappear? Or any suggestions for something I might be missing?

My sshd_config file addition is as follows:

Subsystem sftp internal-sftp
Match Group sftponly
   ChrootDirectory %h
   X11Forwarding no
   AllowTcpForwarding no
   ForceCommand internal-sftp

My sftp-user has their home directory specified on an external drive that is auto-mounted at boot. Their home directory has root ownership and 755 permission.

share|improve this question
It turns out that the Match Group block of code must be inserted at the end of the sshd_config file. Many guides don't explicitly state this and so I overlooked it and thought the code belonged together with the Subsystem line. SSH works fine again; SFTP, however, still isn't connecting (giving a "broken pipe" error). –  Fexar Apr 1 '13 at 19:47
SFTP issue resolution: The external drive is mounted to /mnt/DATA/ with 777 permissions so that everyone can read/write to it. I created a sub-directory /mnt/DATA/sftp/ for the sftp user with 750 permissions and root-ownership which I thought would be sufficient. Unfortunately, sftp requires the entire directory structure to have root/750, including the /mnt/DATA/ directory. So sftp works, but I can't let physical users create new folders inside the base /mnt/DATA/ directory now. Not 100% what I want, but at least it's a step in the right direction. –  Fexar Apr 1 '13 at 20:04
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.