Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Linux server with the following software:

- Ubuntu 10.04 LTS x64
- Linux kernel 2.6.38

Need the following configuration/software:

- SSH through rsa key authentication
- SFTP with the following properties:
    - Single user
    - Access to ONLY /var/www (no home directory what so ever)
    - Rsa key authentication

The server is going to be on the internet, so it needs to be secure. How can I properly do this? I get stuck with the configuration of the SFTP user, he can access FTP but not write anything, also not download. I guess I do something wrong with chown or permissions are not set properly, I just can't figure out what is causing this problem.

sudo apt-get install openssh-server

sudo mkdir /var/www
sudo groupadd sftp_users
sudo useradd -d "/var/www" --groups sftp_users -s /bin/false -p '!' "root_sftp"
sudo passwd root_sftp

sudo chmod 751 /var/
sudo chmod 770 /var/www
sudo chown root:root_sftp /var/www

sudo nano /etc/ssh/sshd_config

Added/changed the following things to the sshd_configuration file

PermitRootLogin no
AuthorizedKeysFile /etc/ssh/authorized_keys
PermitEmptyPasswords no
PasswordAuthentication yes

Subsystem sftp internal-sftp

Match User root_sftp
        ChrootDirectory /var/www
        ForceCommand internal-sftp
        X11Forwarding no
        AllowTcpForwarding no
        PermitRootLogin no
        AllowAgentForwarding no

Now once again, the problem is, the user can login, with a key, the SSH is also working perfect but the SFTP is not working properly.

The user can login with SFTP (I used filezilla) but then he can't upload etc. It seems that the user only has the execute bit (--x or 1)

I really hope someone can help me, it took me a long time to configure already. Thanks for help and your time.

Extracted permission of root, /var and /var/www

# ls -lad / /var /var/www
drwxr-xr-x 22 root root               4096 2012-03-13 22:59 /
drwxr-x--x 15 root root               4096 2012-03-13 23:04 /var
drwxrwx---  3 root root_sftp 4096 2012-03-13 23:15 /var/www

The /var/www directory is empty.

share|improve this question
Don't you want to sudo chown root:sftp_users /var/www ? – cjc Mar 13 '12 at 19:07
Can you give us the output of the current permissions/ownerships of the /var/www directory? Is there content within the directory? I see you didn't recursively apply those permissions changes. – NcA Mar 13 '12 at 19:18
@NcA check my question's edit, I just updated with some more information. – mike vercoelen Mar 13 '12 at 22:24

As root:

mkdir /var/www/files
chown root_sftp:sftp_users /var/www/files

Can your SFTP user put files into what will appear under the chroot as /files? I don't recall immediately, but I think you will not be able to write against the apparent / because of the chroot jail.


Ah, it's actually in the man page for sshd_config:

         Specifies a path to chroot(2) to after authentication.  This path, and all its components, must
         be root-owned directories that are not writable by any other user or group.

So, what you specify as ChrootDirectory in /etc/ssh/sshd_config can't be writeable. You acn rethink your directory setup, so what the document root for your web site is /var/www/, where the subdirectory is writeable by the SFTP user.

share|improve this answer
But why use /var/www/files, I want the user to have access directly to /var/www because that will be the "live" web directory @ apache. – mike vercoelen Mar 13 '12 at 22:58
@mikevercoelen please see the update. – cjc Mar 13 '12 at 23:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.