1

I'm trying to make a user kake_sftp that can log in to the web server located at /var/www/html or similar. I know chroot needs some additional subdirectiories for the permissions to work out, so I'm fine with adding new folders or changing the folder layout a bit.

I created the user in group www-data and with home directory in /var/www/html

$ cat /etc/passwd | grep kake_sftp
kake_sftp:x:1001:1001::/var/www/html:/bin/bash

$ groups kake_sftp
kake_sftp : kake_sftp www-data

Then I did some changes in /etc/ssh/sshd_config. I replaced "Subsystem sftp /usr/lib/openssh/sftp-server" with "Subsystem sftp internal-sftp" and I added the following lines at the end

Match User kake_sftp
ChrootDirectory /var/www
ForceCommand internal-sftp
AllowTcpForwarding no

The permissions of the www folder is set as follows.

$ ls -la /var/www
drwxrwxr-x  3 root root     4096 Apr  7 12:17 .
drwxr-xr-x 12 root root     4096 Apr  4 10:17 ..
drwxr-xr-x  2 root www-data 4096 Apr  4 11:34 html

When I now try to log in with Filezilla set to sftp. I get the following error.

Error:  Network error: Software caused connection abort
Error:  Could not connect to server

When I try to log in with my main user via sftp, it works like a charm. So there isn't a problem with the client.

0

The reason why this did not work was because the chrooted directory had write permissions. By revoking all write permissions, I managed to connect.

chmod 555 /var/www

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.