0

Please help to get this configuration understandable

# override default of no subsystems

Subsystem       sftp    internal-sftp


Match Group sftpusers
  ChrootDirectory /sftp/%u
  ForceCommand internal-sftp

1 Answer 1

1

from man sshd_config:

  • Subsystem Subsystem sftp internal-sftp

    Configures an external subsystem (e.g. file transfer daemon). Arguments should be a subsystem name and a command (with optional arguments) to execute upon subsystem request.

    The command sftp-server(8) implements the “sftp” file transfer subsystem.

  • Match Match Group sftpusers

    Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. If a keyword appears in multiple Match blocks that are satisified, only the first instance of the keyword is applied.

    The arguments to Match are one or more criteria-pattern pairs or the single token All which matches all criteria. The available criteria are User, Group, Host, LocalAddress, LocalPort, and Address. The match patterns may consist of single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS section of ssh_config(5).

  • ChrootDirectory ChrootDirectory /sftp/%u

    Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.

  • ForceCommand ForceCommand internal-sftp

    Forces the execution of the command specified by ForceCommand, ignoring any command supplied by the client and ~/.ssh/rc if present. The command is invoked by using the user's login shell with the -c option. This applies to shell, command, or subsystem execution. It is most useful inside a Match block. The command originally supplied by the client is available in the SSH_ORIGINAL_COMMAND environment variable. Specifying a command of “internal-sftp” will force the use of an in-process sftp server that requires no support files when used with ChrootDirectory.

More infos here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .