9

i'm having trouble forcing users to only be able to use sftp when connecting over ssh.

I have the following lines in my /etc/ssh/sshd_config:

Subsystem sftp /usr/libexec/openssh/sftp-server

Match user USERNAME
ForceCommand internal-sftp

But when I try to connect via sftp, i get the error:

error: subsystem: cannot stat /usr/libexec/openssh/sftp-server: No such file or directory
subsystem request for sftp failed, subsystem not found

However, the file /usr/libexec/openssh/sftp-server does exist and seems to be working fine. If I don't try and force the connection to be sftp, then I can ssh in just fine, so the ssh daemon seems to be handling things correctly, but forcing sftp is not.

Does anyone have any suggestions? I've tried searching for answers but all the solutions i've found seem to be about the sftp-server not being in the correct place. For me though, the file is definitely there.

I'm using CentOS 6, and OpenSSH 5.3p1. Thanks for any help.

3
  • Does SFTP work when the command isn't forced?
    – mgorven
    Apr 23, 2012 at 6:09
  • Yes, sftp works fine when it isn't forced. In that case i get the following message in my /var/log/secure when connecting via sftp: sshd[3569]: subsystem request for sftp
    – Jai Redden
    Apr 23, 2012 at 12:21
  • In my case, on one CentOS 6 minimal install, the sshd_config default path was wrong—it needed to be updated to /usr/libexec/openssh/sftp-server (find out where you have it installed via find / -name "sftp-server"). This was causing Ansible to pop warnings like [WARNING]: sftp transfer mechanism failed on [server] until I fixed it. Mar 17, 2017 at 19:50

1 Answer 1

11

Do you use "ChrootDirectory"? That would explain "file not found" if your "/usr/libexec/openssh/sftp-server" exist.

You should use "Subsystem sftp internal-sftp" instead (or give up on Chroot)

3
  • 1
    That should be Subsystem sftp internal-sftp
    – xebeche
    Nov 17, 2013 at 15:38
  • tnx @xebeche, I've edited it Nov 17, 2013 at 23:23
  • 5
    Note that the sshd_config file is out of sync with the file system on Ubuntu 14. The default is /usr/libexec/openssh/sftp-server but the actual file is /usr/lib/openssh/sftp-server.
    – nortally
    Mar 26, 2015 at 18:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .