Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this setup in sshd_config:

AllowUsers test1 test2

Match group sftpgroup
         ChrootDirectory /var/www
         X11Forwarding no
         AllowTcpForwarding no
         ForceCommand internal-sftp

Match user test2
         ChrootDirectory /var/www/
         X11Forwarding no
         AllowTcpForwarding no
         ForceCommand internal-sftp

I am trying to restrict test2 to only use /var/www/

For some reason when I try to login e.g. with Filezilla on account test2 I get this error: "Server unexpectedly closed network connection"

The users are created and works. the SSH service has been stopped and started. test1 works when using e.g. filezilla and the root of the connection is /var/www. What am I doing wrong?

share|improve this question
up vote 0 down vote accepted

If the answer Cudos supplied does not help you, and I dont think it will (no offense), try this:

chown root:root /your/chroot/home
chmod 700 /your/chroot/home
chown user:sftpgroup /your/chroot/home/userdir
chmod 755 /your/chroot/home/userdir

remember: your users wont be able to write in their "root", you need to create a directory for them to use.

share|improve this answer

Thanks for bringing this feature of SSH to my attention.

The following Debian Administration article states that the target directory must be owned by root - perhaps /var/www/ is not.

share|improve this answer
yeah, thanks for showing me too. this kind of config for sftp is new to me also... "Specifying a command of ``internal-sftp'' will force the use of an in-process sftp server that requires no support files when used with ChrootDirectory." – djangofan Apr 23 '10 at 21:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.