Setting up SFTP users that are jailed to their home directories with Chef

Question

I'm hoping someone can help me figure out how to chroot jail users to their home directories for SFTP with Chef. I've tried multiple SSH cookbooks and Googled for an answer for several days with no luck (though honestly it's possible I just don't know what to search for).

What I've done so far is setup a data bag for users that successfully creates the users, assigns them to an sftponly group, and creates their home directory in a domain.tld format.

My problem is that once I try to connect via SFTP I can successfully be placed in the user's home directory, but can simply move up to either the parent directory or the root directory of the server. I've setup SFTP before, it was full of problems but I finally got it to work. I'd like to be able to just have all of the setup handled by Chef though.

This is what I need to know:

1. Which Chef cookbook should I use?
2. What attributes / settings do I need to specifically set to Chroot jail a user in the sftponly group to their home directory while still allowing the root user SSH access?

Answer 1

The final step for SFTP chroot is after creating a sftponly group and configuring openssh is ensuring the user’s $HOME is owned by root. If the user owns their home directory, the sftponly configurations will not be applied.

Next, you can sudo mkdir a directory within that user’s $HOME and ensure the user owns that directory—this is where they can upload files. I typically add a public directory within the root-owned $HOME directory where other users and processes can drop files.