Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Can anyone see what I have done wrong in this procedure? I can connect to the server as the new user and am in the chrooted directory, but despite setting all the proper root permissions, I cannot add files or directories.

sudo mkdir /var/host
sudo groupadd sftp
sudo useradd john -d / -M -N -G sftp -s /bin/false
sudo passwd john

sudo nano /etc/ssh/sshd_config

Match Group sftp
  ChrootDirectory /var/host
  ForceCommand internal-sftp

service ssh restart

Here are the directory permissions

drwxr-xr-x  2 root root     4096 Jan 24 14:27 host

* UPDATE *

Ok, I think I understand now. Let me know if this looks good:

sudo mkdir /var/sftp
sudo mkdir /var/sftp/host
chown john:sftp /var/sftp/host
sudo groupadd sftp
sudo useradd john -d /var/sftp/host -M -N -G sftp -s /bin/false
sudo passwd john

sudo nano /etc/ssh/sshd_config

Match Group sftp
  ChrootDirectory /var/sftp/host
  ForceCommand internal-sftp
  X11Forwarding no
  AllowTcpForwarding no

sudo service ssh restart

Only problem with this solution is that only John can add files and directories i think, or can any member of SFTP?

share|improve this question

1 Answer 1

  • I won't make a user with home directory set to /.

  • /var/host/ is correctly owned by root and 755 as it is needed for the chroot to work. Because it is owned by root of course user john can't write to it.

  • For user john you have to create subdirectories under /var/host/ for which he has write permission. john will never be able to write directly to the chroot (/var/host/) as it would be insecure so sftp doesn't allow that.

share|improve this answer
    
Hmm but then how do I make the directory appear as root to the user? –  Atomiklan Jan 24 at 20:23
    
ie if I create /var/sftp/host when John logs in he will be able to back out of host to see all the directories in /var/sftp –  Atomiklan Jan 24 at 20:24
    
This should just be a single large directory /var/host that lots of users have access to. A large directory for uploading and downloading hosted files. –  Atomiklan Jan 24 at 20:26
    
@Atomiklan /var/host/ will appear as /. Yes, he will be able to go out to see other directories under /var/host/ but he will not be able to access those other directories if you don't give him read+execute access on those other dirs. If you just want a single large directory as you say, then use /var/host/ as / just like now, and make only one subdirectory under it. Then the users will only have access to this subdirectory. –  falconer Jan 24 at 20:30
    
@Atomiklan To say it differently: "ie if I create /var/sftp/host when John logs in he will be able to back out of host to see all the directories in /var/sftp" Why make other directories under /var/sftp/ if you only need one dir? –  falconer Jan 24 at 20:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.