Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The How To's all talk of patching an old version, and the patch is no longer available.

I'm running debian etch.

share|improve this question
up vote 13 down vote accepted

I am using rssh for this purpose.

You are right there is a new way to do it and it is a built-in feature of recent ssh versions.

Here is an article on Undeadly.

share|improve this answer

I just had to setup one user who would be able to log in via ssh and the ssh to another server (which is not directly connected to the outside world). The links by cstamas and ericmayo were a good start.

Basically, I added the following to /etc/ssh/sshd_config:

Match User myuser
  ChrootDirectory /chroot/myuser

From there on, I just had to create the chroot environment below /chroot/myuser. I copied /bin/bash and /usr/bin/ssh and the shared libraries they needed (ldd will show those). For a larger environment, it would probably make sense to compile statically linked versions of the needed executables.

Bash worked right away, for ssh to work, I also had to create the .ssh directory, copy /etc/passwd, /etc/nsswitch.conf and /lib/libnss_* and create /dev/null, /dev/tty and /dev/urandom via mknod.

share|improve this answer
mkdir /chroot
mkdir -p /chroot/home/<user_name>

mkdir /chroot/home/<user-name>/bin  
cp -pr /bin/bash /chroot/home/<user_name>/bin/.  
cp -pr /bin/ls /chroot/home/<user_name>/bin/.  
cp -pr /lib64 /chroot/home/<user_name>/.

You have to edit the /etc/sshd_config file and addd

ChrootDirectory /chroot/%h

And restart sshd daemon.

All being said, I honestly think that sftp is a better option.

Also, I found this url if it is helpful.

share|improve this answer

If you are using public-key authentication you could use the "command" option in authorized keys to setup the chroot jail.


command="/path/to/the/chroot/script" ssh-dss keydata.....keydata... user@host
share|improve this answer
I am not using Public key authentication, authentication is done by a password and username – Malfist Jul 13 '09 at 17:19

As far as I know new versions of OpenSSH only allows chroot for SFTP connections. I tried and it works. But for SSH the solution available is the chrootssh patch. I browse the SourceForge site and there are no files so I think is discontinued.

For Debian Etch there are some files here:

There are other solutions here: , including chrootssh .

share|improve this answer
-1 Sorry, your Answer was correct years ago when you wrote it, but no longer is. – Chris S Oct 8 '12 at 15:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.