3

I want a user to access only its directory. So I have to add the following lines to /etc/ssh/sshd_config

Subsystem sftp internal-sftp
Match Group sftp
        ChrootDirectory /home/%u
        ForceCommand internal-sftp
        AllowTcpForwarding no

When I restart SSH :

service ssh restart

The following error is displayed :

Job for ssh.service failed because the control process exited with error code. See "systemctl status ssh.service" and "journalctl -xe" for details.

More details :

 ssh.service - OpenBSD Secure Shell server
   Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sat 2016-12-10 19:07:57 CET; 27s ago
  Process: 1928 ExecStart=/usr/sbin/sshd -D $SSHD_OPTS (code=exited, status=255)
 Main PID: 1928 (code=exited, status=255)

Dec 10 19:07:57 vps307796 systemd[1]: Starting OpenBSD Secure Shell server...
Dec 10 19:07:57 vps307796 sshd[1928]: /etc/ssh/sshd_config line 93: Directive 'UsePAM' is not allowed within
Dec 10 19:07:57 vps307796 systemd[1]: ssh.service: Main process exited, code=exited, status=255/n/a
Dec 10 19:07:57 vps307796 systemd[1]: Failed to start OpenBSD Secure Shell server.
Dec 10 19:07:57 vps307796 systemd[1]: ssh.service: Unit entered failed state.
Dec 10 19:07:57 vps307796 systemd[1]: ssh.service: Failed with result 'exit-code'.

The response of "Jakuje" corrects the error. But I can not connect with a ftp client :

#  Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

        Match Group sftp
        ChrootDirectory /home/%u
        ForceCommand internal-sftp
        AllowTcpForwarding no

enter image description here

  • 2
    Now you are supposed to run the two commands mentioned in the error text: "systemctl status ssh.service" and "journalctl -xe" .. and, if they dont give you a clue about the problem, edit your question with the output of those commands. – Soren A Dec 10 '16 at 17:39
  • @Soren A I start with my server. I have updated the question. – Mathieu Dec 10 '16 at 18:13
  • It says that there is an error lin line 93 of /etc/ssh/sshd_config. Coul that relate to your newly added lines ? – Soren A Dec 10 '16 at 19:21
4
...: /etc/ssh/sshd_config line 93: Directive 'UsePAM' is not allowed within

... match block.

You wrote the snippet of the configuration some place before the line 93 and therefore the UsePam option felt into this block too. Move your created snippet (Match Group ...) to the end of file and you shuold be good.

| improve this answer | |
  • Thank you for your reply. But I encounter another mistake. I have updated the question – Mathieu Dec 11 '16 at 17:12
  • Well, that is different thing to discuss, but having a look into the error log is again a good start before filling a new question. – Jakuje Dec 11 '16 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.