Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a user who is jailed.


Subsystem sftp internal-sftp

Match user matt
     ChrootDirectory %h
     X11Forwarding no
     AllowTcpForwarding no


matt:x:1001:5006:Matt Ryan,,,:/home/matt:/home/matt/bin/bash

This works perfectly for sftp. The user is limited to his home folder, and whatever mounts are there.

But, I'd like to also give this use shell access. This is what happens when they attempt to log in:

$ ssh
Linux devnode 2.6.38-linode31 #1 SMP Mon Mar 21 21:22:33 UTC 2011 i686 GNU/Linux
Ubuntu 10.04.2 LTS

Welcome to Ubuntu!
 * Documentation:
Last login: Thu Mar 31 13:04:29 2011 from
/home/matt/bin/bash: No such file or directory
Connection to closed.

Via fstab, the bin folder is mounted to the home directory and is present.

Why am I getting this error.. and how can I solve this?

Thanks for the help!

share|improve this question
up vote 3 down vote accepted

When you chroot, the named directory becomes /. The correct shell path inside the chroot is then /bin/bash, not /home/matt/bin/bash.

You will also need to make sure there's enough other stuff inside the chroot for the system to work. You can test this with sudo chroot /home/matt /bin/bash and see what works and what doesn't; at the very least, you will probably want a dummy /etc, a bind mount of /proc, and much of /lib inside the chroot.

share|improve this answer
@geekosaur, thanks a lot... i just mounted the entire /proc and /lib folders to his home to test and it was successful. another question though, are bind mounts costly in anyway? – matt ryan Mar 31 '11 at 17:45
Bind mounts are essentially free. – geekosaur Mar 31 '11 at 17:46
great. one more for bonus: how can i enable color support for this user's shell – matt ryan Mar 31 '11 at 18:14
GNU ls wants some setup done by scripts in /etc/profile.d. Some programs may also want to see /usr/share/terminfo/*/*. – geekosaur Mar 31 '11 at 18:19
seriously, thanks for you help. i'm having trouble bind mounting the /usr/bin here though. is there a better way to enable access to that? – matt ryan Mar 31 '11 at 18:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.