0

I want to default a given user to a specific folder when they SFTP to my Ubuntu 18.04 machine. I also wanted to lock down SFTP a bit. This Digital Ocean post gave me what I needed, and helped me get a start, but it's not working as I hoped it would.

I created a folder called /var/sftp/my_username. Then I updated sshd_config to include these settings:

Match User my_username
ForceCommand internal-sftp
PasswordAuthentication yes
ChrootDirectory /var/sftp/
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no

My hope was that my_username would land in /var/sftp/my_username and be trapped there. Instead, the user lands in /var/sftp and must open'my_username' in order to move to a directory that they can upload to. This is a problem because /var/sftp will eventually list other sftp subfolders for other users (IE /var/sftp/your_username).

What can I do to default this user to /var/sftp/my_username? I have already tried changing the user's home directory this this location, without luck.

Thanks!

2 Answers 2

0

I believe you need to change the entry 'ChrootDirectory /var/sftp/' in sshd_config to something like 'ChrootDirectory /var/sftp/my_username'

0

Thanks Olav. I did try that in my original troubleshooting. It does not work. I'm not able to set up ChrootDirectory to any directory that Root does not own.

I solved this problem by just creating an additional folder layer:

ChrootDirectory /var/sftp/my_username/my_username

The /var/sftp folder has several usernames for different users. Each user is Chroot'd to their top level my_username folder. They cannot write to /var/sftp/my_username but they own /var/sftp/my_username/my_username and can just open that subfolder and do as they please.

This gives them write ability and hides other folders from other users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .