1

I would like to create sftp user account on Ubuntu server which has read/write access only to one specific folder. I would like this user to have rights to transfer files up and from my server via sftp. My server is hosted on Digital Ocean.

I have followed this tutorial on Digital Ocean which seems to do exactly what I want but I got stuck at Step 4.

Step 4 says that you try this command:

ssh sammyfiles@localhost

And result should be:

Error message
This service allows sftp connections only.
Connection to localhost closed.

Instead my result is:

packet_write_wait: Connection to 207.154.238.143 port 22: Broken pipe
Connection closed

Next it instructs running this, which should obviously work:

sftp sammyfiles@localhost

The result should be:

SFTP prompt
Connected to localhost.
sftp>

but instead I get:

forge@BitCloud:~$ sftp misjah@localhost
misjah@localhost's password: 
packet_write_wait: Connection to 127.0.0.1 port 22: Broken pipe
Couldn't read packet: Connection reset by peer

I get the same message if I want to sftp with this newly created user from outside:

prmbair:~ primozrome$ sftp misjah@207.xxx.xxx.xxx
misjah@207.xxx.xxx.xxx's password: 
packet_write_wait: Connection to 207.154.238.143 port 22: Broken pipe
Connection closed
prmbair:~ primozrome$ 

What am I doing wrong?

Update from comments: Seems like problem is in the sshd_config - ChrootDirectory line. If I use ChrootDirectory %h then sftp to users home directory works, but if I use ChrootDirectory /home/user/uploads (to restrict only to one folder) then:

packet_write_wait: Connection to 127.0.0.1 port 22: Broken pipe. 
Couldn't read packet: Connection reset by peer. 

Any idea?

  • @user68186 tried adding ClientAliveInterval 60 this but I get the same result – Primoz Rome Aug 30 '17 at 15:11
  • The only idea I have is make sure you enter the /home/[username]/uploads in the exact case as it appears in the system. In other words, make sure it is uploads and not Uploads. Best of luck. – user68186 Aug 31 '17 at 16:15
2

From https://man.openbsd.org/sshd_config

ChrootDirectory Specifies the pathname of a directory to chroot(2) to after authentication. At session startup sshd(8) checks that all components of the pathname are root-owned directories which are not writable by any other user or group.

I had the same problem and the solution was to avoid using a directory in a user's home, as the /home/user directory should not be owned by root, but to create instead a directory in e.g. /var/sftp/uploads, where /var/sftp/ is root owned and /var/sftp/uploads is owned by the sftp user. Then I can chroot the sftp user in uploads.

ChrootDirectory /var/sftp

in /etc/ssh/sshd_config

0

I think there is a mistaken about the rights...

Could you show us the return of the command ls -l in your directory /var/sftp please ?

I think /var/sftp have 755 rights but not /var/sftp/uploads because the chmod command isn't recursive if we don't tell it, so you would have to type : sudo chmod 755 -R /var/sftp (the -R parameter for recursive). With -R, all subdirectories in /var/sftp will have 755 rights.

Could you try it please ?

Good luck !

  • Seems like problem is in the sshd_config - ChrootDirectory line. If I use ChrootDirectory %h then sftp to users home directory works, but if I use ChrootDirectory /home/user/uploads (to restrict only to one folder) then packet_write_wait: Connection to 127.0.0.1 port 22: Broken pipe. Couldn't read packet: Connection reset by peer. Any idea? – Primoz Rome Aug 30 '17 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.