1

I want to create a new user and restrict the user for only sftp access where also the user is restricted within a directory and cannot access root directory.

I did the following steps:

1) created a new group called sftp-users.

2) created a new user called myUser and set its password.

3) added myUser to sftp-users group.

4) /var/www/example.com is the project directly within which I want to restrict this users SFTP access. I used usermod command to set this directory as home directory of myUser.

5) Used: usermod -s /sbin/nologin myUser to restrict shell access

6) On /etc/ssh/sshd_config file I commented the following line

#Subsystem sftp /usr/lib/openssh/sftp-server

and added the following line instead of it

Subsystem sftp internal-sftp

Finally at the bottom of the file I added following rules

Match Group sftp-users
        ChrootDirectory %h
        ForceCommand internal-sftp

Now when I try to login using:

ssh myUser@localhost

After entering the password and it gives me the following error

packet_write_wait: Connection to 127.0.0.1 port 22: Broken pipe
Couldn't read packet: Connection reset by peer

Ownership details of the /var directory:

drwxr-xr-x 14 root root   4096 Jan 15  2018 ./
drwxrwxr-x 23 root root   4096 Jul  4 06:08 ../
drwxr-xr-x  2 root root   4096 Jul 20 06:25 backups/
drwxr-xr-x 12 root root   4096 Jun 23 17:00 cache/
drwxrwxrwt  2 root root   4096 Jan 12  2018 crash/
drwxr-xr-x 53 root root   4096 Jun 23 17:00 lib/
drwxrwsr-x  2 root staff  4096 Apr 12  2016 local/
lrwxrwxrwx  1 root root      9 Jan 12  2018 lock -> /run/lock/
drwxr-xr-x 11 root syslog 4096 Jul 20 06:25 log/
drwxrwsr-x  2 root mail   4096 Jan 12  2018 mail/
drwxr-xr-x  3 root root   4096 Jun 23 16:14 opt/
lrwxrwxrwx  1 root root      4 Jan 12  2018 run -> /run/
drwxr-xr-x  2 root root   4096 Nov 30  2017 snap/
drwxr-xr-x  5 root root   4096 Jan 15  2018 spool/
drwxrwxrwt  4 root root   4096 Jul 20 01:45 tmp/
drwxr-xr-x  4 root root   4096 Jul  9 08:05 www/

Ownership details of the /var/www directory:

drwxr-xr-x  4 root        root      4096 Jul  9 08:05 ./
drwxr-xr-x 14 root        root      4096 Jan 15  2018 ../
drwxr-sr-x  6 myUser      user2     4096 Jul 18 15:36 example.com/
  • 1
    root has to be the user which owns the chrooted dir. For the chroot to be created, you need superuser, which is why you need to have root own that directory/folder. Something about 'jailed chroot' or something. Discovered that when making a chroot jail for one of my users on a specific server at work. – Thomas Ward Jul 20 '18 at 15:46
  • drwxr-sr-x 6 root root 4096 Jul 18 15:36 example.com/ This is the details after changing ownership to root but still same error. – Pushpa Raj Jul 20 '18 at 16:00
  • No, I said only change the owner user not the group... you can't apply the chroot without the group being set properly. sudo chown root:sftp-users /var/www/example.com – Thomas Ward Jul 20 '18 at 16:03
  • @ThomasWard ok done drwxr-sr-x 6 root sftp-users 4096 Jul 18 15:36 example.com/ But still the same error – Pushpa Raj Jul 20 '18 at 17:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.