I want to create a new user and restrict the user for only sftp access where also the user is restricted within a directory and cannot access root directory.
I did the following steps:
1) created a new group called sftp-users
.
2) created a new user called myUser
and set its password.
3) added myUser
to sftp-users
group.
4) /var/www/example.com
is the project directly within which I want to restrict this users SFTP access. I used usermod
command to set this directory as home directory of myUser
.
5) Used: usermod -s /sbin/nologin myUser
to restrict shell access
6) On /etc/ssh/sshd_config
file
I commented the following line
#Subsystem sftp /usr/lib/openssh/sftp-server
and added the following line instead of it
Subsystem sftp internal-sftp
Finally at the bottom of the file I added following rules
Match Group sftp-users
ChrootDirectory %h
ForceCommand internal-sftp
Now when I try to login using:
ssh myUser@localhost
After entering the password and it gives me the following error
packet_write_wait: Connection to 127.0.0.1 port 22: Broken pipe
Couldn't read packet: Connection reset by peer
Ownership details of the /var
directory:
drwxr-xr-x 14 root root 4096 Jan 15 2018 ./
drwxrwxr-x 23 root root 4096 Jul 4 06:08 ../
drwxr-xr-x 2 root root 4096 Jul 20 06:25 backups/
drwxr-xr-x 12 root root 4096 Jun 23 17:00 cache/
drwxrwxrwt 2 root root 4096 Jan 12 2018 crash/
drwxr-xr-x 53 root root 4096 Jun 23 17:00 lib/
drwxrwsr-x 2 root staff 4096 Apr 12 2016 local/
lrwxrwxrwx 1 root root 9 Jan 12 2018 lock -> /run/lock/
drwxr-xr-x 11 root syslog 4096 Jul 20 06:25 log/
drwxrwsr-x 2 root mail 4096 Jan 12 2018 mail/
drwxr-xr-x 3 root root 4096 Jun 23 16:14 opt/
lrwxrwxrwx 1 root root 4 Jan 12 2018 run -> /run/
drwxr-xr-x 2 root root 4096 Nov 30 2017 snap/
drwxr-xr-x 5 root root 4096 Jan 15 2018 spool/
drwxrwxrwt 4 root root 4096 Jul 20 01:45 tmp/
drwxr-xr-x 4 root root 4096 Jul 9 08:05 www/
Ownership details of the /var/www
directory:
drwxr-xr-x 4 root root 4096 Jul 9 08:05 ./
drwxr-xr-x 14 root root 4096 Jan 15 2018 ../
drwxr-sr-x 6 myUser user2 4096 Jul 18 15:36 example.com/
root
has to be the user which owns the chrooted dir. For the chroot to be created, you need superuser, which is why you need to haveroot
own that directory/folder. Something about 'jailed chroot' or something. Discovered that when making a chroot jail for one of my users on a specific server at work.drwxr-sr-x 6 root root 4096 Jul 18 15:36 example.com/
This is the details after changing ownership to root but still same error.sudo chown root:sftp-users /var/www/example.com
drwxr-sr-x 6 root sftp-users 4096 Jul 18 15:36 example.com/
But still the same error