Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not sure if this is possible or not. I'm running an Ubuntu Server 11.10 and have set up a Subversion repository in /home/svn and I have an sftp folder in /home/ftp.

My users can access each fine from the client side using ssh keys. I found that when using the ftp client they could browse the entire server, so I added these lines to my sshd_config file to have my users jailed to the ftp folder.

Match group workers
    ChrootDirectory /home/ftp
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp

The problem is they can't access the subversion repository. Is there anyway of getting something like this working?


Here is the sshd_config file

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22 
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes
AllowGroups sshlogin

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  /home/.ssh/%u/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
Banner /etc/

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

#Subsystem sftp /usr/lib/openssh/sftp-server -u 0022

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM no

Subsystem sftp internal-sftp -u 0022
Match group workers
    ChrootDirectory /home/ftp
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp
share|improve this question

That is because you chrooted the sftp user to /home/ftp, so their root folder (/) will be in that folder and all files/folders inside it will be available.

The problem is that /home/svn is at the same level /home/ftp, and it cannot be reached. For make it reachable by users you can make your svn folder as /home/ftp subfolder. Or you can try bind the svn folder as a subfolder of /home/ftp with:

mount -o bind /sourcefolder /destinationfolder/
share|improve this answer
I did try creating the repository inside the /home/ftp folder but it was still unreachable. – Lee Oct 15 '11 at 15:53
did you checked permission? Do you receive some error? Or simply you cannot find that folder? – Ivan Oct 15 '11 at 16:08
I have checked the permissions and they are working fine. From the client I get a message that I'm unable to connect to the repository. If I remove the lines from my sshd_config file everything works fine again, but the users are free to roam around the server. – Lee Oct 15 '11 at 16:26
But i don't understand: you want that ftp users also must access (cd) to svn folder or the problem is that if you setup the sftp server with chroot you have problems with svn? And how is your svn is configured? Are you using svnserve? Or svn over http + ssh access? – Ivan Oct 15 '11 at 16:57
The clients use FileZilla with an ssh key to access the /home/ftp directory. They also use Tortoise using svn+ssh:// to access the repository. From FileZilla they can leave the ftp folder and access the whole server, which is what I want to stop. By adding the lines above to sshd_config I can stop users leaving the /home/ftp directory, but then Tortoise refuses to access the repository. – Lee Oct 15 '11 at 17:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.