Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have setup SFTP on our development box and would like to jail users into the /var/www/project folder

I have added the following to /etc/ssh/sshd_config

Match Group developers
    ChrootDirectory /var/www/project
    X11Forwarding no
    AllowTCPForwarding no
    ForceCommand /usr/lib/openssh/sftp-server

When I attempt to SFTP in, I receive error

Couldnt read packet: connection reset by peer

I thought that this might be a permissions issues, Ive chmod /usr/lib/openssh/sftp-server to 755 - still no luck

Any suggestions?

share|improve this question
    
You might try setting the server logging to a DEBUG setting. You do this in /etc/ssh/sshd_config LogLevel DEBUG3 would give you the most info. If sftping via linux you can also pass in -vvv to get more information. Reset by peer usually means the client has a problem with something. –  Joshua Enfield Sep 6 '10 at 0:46
    
ok so I got the error bad owner or mode for /var/www/project so I chown it to root/root and it works, however, I dont want the directory to be owned by root as this causes problems with user write permissions etc, am I taking the wrong approach? –  Tim Sep 6 '10 at 2:11
add comment

1 Answer

sorry i can't comment, so i have to answer directly.

the permissions with the build-in chroot system is a little bit tricky, i use the same method to create sftp only users:

part of my sshd_config:

Match group developers
    ChrootDirectory /home/%u/userdata

where %u matches every username here

assuming the following path

/home/developername/datadirectory/upload

permissions:

developername root:root rwxr-xr-x
datadirectory root:root rwxr-xr-x
upload developername:developers rwx------

if a user logs the directroy listing of / shows "upload"

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.