I need a simple and easy way to jail users in their home directories in Oneiric. Do you have a simple configuration for jailing users, with full help, or some good web links?

I would be offering an online free public server with 10 to 20 GB free space. I don't know how many users. I want to give them SSH and SFTP so that they can connect through FileZilla.

  • 2nd update if users are not locked in home directories
    – One Zero
    Jan 10, 2012 at 17:33
  • then I believe you 1-as mentioned by @Marco you want to try ChrootDirectory for SSH 2- you may want to go beyond the standard ways of doing things as you need to scale this to handle "a lot" of storage, ... 3- Is SSH your best choice? do people need SSH on your service? 4- Good luck
    – Ali
    Jan 10, 2012 at 18:10
  • 1
    i have other plan as well .... for normal users we would be offering only SFTP with MY SECURE SHELL , that's very easy 2 handle
    – One Zero
    Jan 10, 2012 at 18:23
  • How can I remove this jail e.g.(home/jail)?<br> And when I add some jail section e.g. jk_init -v -f /home/jail netutils, how will I remove this?
    – user294399
    Jun 17, 2014 at 16:00

4 Answers 4


Jailkit is a set of utilities that can limit user accounts to a specific directory tree and to specific commands. Setting up a jail is much easier using the Jailkit utilities that doing so 'by hand'. A jail is a directory tree that you create within your file system; the user cannot see any directories or files that are outside the jail directory. The user is jailed in that directory and it subdirectories.

Download & Install:


VERSION=2.20 # from November 2018
cd /tmp
wget https://olivier.sessink.nl/jailkit/jailkit-$VERSION.tar.gz
tar -zxvf jailkit-$VERSION.tar.gz
cd jailkit-$VERSION/
su -
make install

Setting up the jail

Now it’s time to set up the jail directory. Jailed users will see this directory as the root directory of the server. I chose to use /home/jail:

mkdir /home/jail
chown root:root /home/jail

jk_init can be used to quickly create a jail with several files or directories needed for a specific task or profile, (click on it & read full detail ).

jk_init -v /home/jail basicshell
jk_init -v /home/jail netutils
jk_init -v /home/jail ssh
jk_init -v /home/jail jk_lsh

Add a user

Add a new user with a home directory and bash shell, and set the password:

useradd -d /home/jailtest -m jailtest -s /bin/bash
passwd jailtest

Now it’s time to jail this user

use the following command:

jk_jailuser -m -j /home/jail jailtest

Your /etc/passwd should contain something like this now:


Enable bash

By using jk_cp the bash libraries are copied to the jail:

jk_cp -v -f /home/jail /bin/bash

Edit /home/jail/etc/passwd

replace this line:


with this:



By using jk_update updates on the real system can be updated in the jail.

A dry-run will show what’s going on:

jk_update -j /home/jail -d

Without the -d argument the real update is performed. More maintenance operations can be found here.

(In case /home/jail/opt is missing, create it with mkdir -p /home/jail/opt/ And run jk_update -j /home/jail again)

Give access to other directories

You can mount special folders, that the jail user may acces now. E.g.:

mount --bind /media/$USER/Data/ /home/jail/home/jailtest/test/

Help Taken


http://olivier.sessink.nl/jailkit/index.html#intro ( a very good help )

This one also

This is been checked & verified , Working Properly

  • +1 very good. highly recommend reading the links you mentioned above in the "Help Taken" section too
    – cwd
    May 24, 2013 at 22:41
  • 2
    This doesn't work on Ubuntu 13.10. When you try to finally login you get the welcome message immediately followed by connection closed.
    – hookenz
    Feb 9, 2014 at 23:52
  • Matt H: Make sure to follow the last two steps; copying the bash binaries and editing the /home/jail/etc/passwd file.
    – ONOZ
    May 20, 2014 at 10:10
  • 2
    This either doesnt work anymore or something has changed since this tutorial was put up. Im getting exactly the same problems as MattH. Oct 14, 2014 at 21:15
  • I also had the connection closed issue immediately after the welcome message. I changed the login shell within the chroot passwd file from jk_lsh to bash as read here linuxquestions.org/questions/linux-software-2/… It is not a solution but a workaround! Feb 26, 2015 at 15:30

You can not confine them to /home as they need access to the system binaries and bash and configuration files in /etc

IMO the easiest method of securing users is to use apparmor.

You make a hard link

ln /bin/bash /usr/local/bin/jailbash

You add jailbash to /etc/shells

You then assign jailbash to the users shell, and then write an apparmor profile for jailbash allowing minimal access.

sudo chsh -s /usr/local/bin/jailbash user_to_confine

You will have to write an apparmor profile yourself, but I have a profile you could potentially start with


  • You can not confine them to /home as they need access to the system binaries and bash and configuration files in /etc There is nothing stopping you from linking/copying files you feel they need.
    – user606723
    Jan 6, 2012 at 21:52
  • 1
    Yes you "can" do as user606723 suggests, but it is not so easy, and IMO of all the potential solutions the least practical or easy. Might as well build a chroot or use lxc. You copy a binary, then the libs. Often you will manually need to identify libs with ldd. This method takes a ton of work to set up. And then you have to keep the jail up to date, you will have to manually update (copy) the binaries / libs. Links might work better in terms of updates, but you still need to set them all up. Somehow I do not think this is what the OP had in mind. How then to keep them confined ?
    – Panther
    Jan 6, 2012 at 22:08
  • 1
    I think the whole point of the question was to point out tools to automate this process... like jailkit, a tool the OP mentions.
    – user606723
    Jan 6, 2012 at 22:28
  • @bodhi.zazen . what u think about about this .. debootstrap (oneiric) then make a container using lxc . using jail kit > user to container > . what i did so far is i have debbootstrap oneiric minimum then used jailkit >working fine
    – One Zero
    Jan 7, 2012 at 14:44
  • you can use LXC for this task, beware that isolation is sometimes incomplete with LXC. As long as users do not have root access in the container you should be OK and you may want to subscribe to the LXC mailing list.
    – Panther
    Jan 7, 2012 at 15:06

It's difficult to guess what purpose you might want to accomplish. If it is to deny ssh/sftp while providing jailed access via FTP... easy:

Add to /etc/shells a new shell:

sudo -e /etc/shells

Add one line:


Save. For each user you want to deny ssh/sftp, change the user's shell:

sudo chsh -s /bin/false userx

Now userx cannot log in via ssh/sftp.

Install vsftpd:

sudo apt-get install vsftpd

Edit the config file:

sudo -e /etc/vsftpd.conf

And some changes....


Save. Restart vsftpd:

sudo /etc/init.d/vsftpd restart
  • well i m want to give them ssh + sftp (connect through filezilla)
    – One Zero
    Jan 7, 2012 at 5:55

You could check out rbash as a shell for your users.

man bash

Search for RESTRICTED SHELL section

Or look on this page http://linux.die.net/man/1/bash

  • 3
    Just be very careful with rbash, it is very easy to break out of and sort of considered outdated. See blog.bodhizazen.net/linux/how-to-restrict-access-with-rbash
    – Panther
    Jan 6, 2012 at 21:43
  • @bodhi.zazen You mean rbash?
    – Karlson
    Jan 6, 2012 at 21:47
  • yes, sorry I fixed that. There was a blog several years ago where someone broke our of a rbash jail I set up, and I though it was tight, minimal jail. Took them less then 5 minutes. Not had anyone break out of jailbash.
    – Panther
    Jan 6, 2012 at 21:49
  • can u plz tell me how do i configure it ....jailbash
    – One Zero
    Jan 7, 2012 at 13:24
  • yes, man bash helps, using bash restrited shell capabilities is more simply
    – c4f4t0r
    Feb 26, 2014 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.