Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I followed the "Chroot and Debian" tutorial in

Then when I log into user "upload" via ssh I have no access to the command line (this is what I wanted).

But then when I SFTP into the upload user I can still see all the root files (/), it didn't chroot me to just /home/upload whats going on?


I added this to the end of my /etc/ssh/sshd_config file, then done a restart

Subsystem sftp internal-sftp

UsePAM yes

Match User upload
    ChrootDirectory /home/upload
    AllowTCPForwarding no
    X11Forwarding no
    ForceCommand internal-sftp

Then when I log into sftp I can only see my upload folder (this is what I want), but now scp doesn't work :P

SCP will accept my password then:

debug1: Next authentication method: password
upload@'s password: 
debug1: Authentication succeeded (password).
debug1: channel 0: new [client-session]
debug1: Requesting
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = en_NZ.UTF-8
debug1: Sending command: scp -v -t /test

It will hang on that last debug message.

Any help would be greatly appreciated.

Note, running Debian Lenny

share|improve this question
up vote 2 down vote accepted

You are not using scponly here. You have restricted the user upload to using SFTP, so you can't use scp on that account since scp relies on an interactive shell or at least a shell which supports certain commands (like scponly or rssh).

Use sftp or another SFTP client (e. g. lftp) to access that account or remove the ForceCommand and ChrootDirectory directives from your sshd_config.

share|improve this answer
I don't want to use sftp as I don't need human interaction, I just need it for a script to transfer a file or two to the server now and then. From what I'v read scp is the idea tool for that. Oh and when I take out the chroot made by sshd I get full access to all my directories, Ill try compile scponly as suggested below but I fear it wont help. – Mint Mar 2 '10 at 23:53
SFTP is just a protocol. Clients like lftp also support non-interactive modes. And even sftp (OpenSSH's SFTP client) supports batch mode (see parameter -b). – joschi Mar 3 '10 at 5:42
Yeah I know, but I still like scp, as it's supposed to be somewhat faster at copying. – Mint Mar 4 '10 at 3:38
I really doubt that scp is faster than sftp. Nevertheless, I've already described in the last paragraph of my answer what you have to do to make scp work again. – joschi Mar 4 '10 at 9:13
Yeah, scponly works fine via apt-get install on my test server, but didn't on the live one… So I might re-install the live one and see how it goes from there. – Mint Mar 5 '10 at 1:39

scponly supports chroot natively. There are compile-time options to enable it, particularly --enable-chrooted-binary. scponly will need the SUID bit to enable chroot.

If already compiled, you will have the binary file scponlyc available on your filesystem.

There are also limitations as to the usefulness of chroot as a security solution.

share|improve this answer
So I have to compile scponly with chroot? I can't enable it from an apt-get install? I choose yes when this message came up when installing scponly via apt-get: – Mint Mar 2 '10 at 23:48
Sounds/looks like that will cover you, Mint. – Warner Mar 3 '10 at 0:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.