Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to set up an sftp server on ubuntu/precise on EC2. I have been successful in adding a new user that can connect via ssh, however once I add the following clause:

Match Group sftp
    ChrootDirectory /home/%u
    AllowTCPForwarding no
    X11Forwarding no
    ForceCommand internal-sftp

I can no longer connect (at all, ssh or otherwise) and I get the message

Error: Connection refused
Error: Could not connect to server

I am able to connect with the subsystem set to:

#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

Any idea why the ssh server is failing with this "Match" clause? Essentially, everything is working except for the "chroot" part.

share|improve this question
up vote 11 down vote accepted

Ok, solved the issue:

2 things were causing a problem

  1. I had to move the "Match" Clause to the END of the file, it was in the middle
  2. There was a permissions issue - found the answer elsewhere that fixed it


"All this pain is thanks to several security issues as detailed here. Basically the chroot directory has to be owned by root and can't be any group-write access. Lovely. So you essentially need to turn your chroot into a holding cell and within that you can have your editable content.

sudo chown root /home/bob
sudo chmod go-w /home/bob
sudo mkdir /home/bob/writable
sudo chown bob:sftponly /home/bob/writable
sudo chmod ug+rwX /home/bob/writable

And bam, you can log in and write in /writable."

share|improve this answer
Thank you so much, I spent hours trying to fix this... my directory was group writeable. Cheers! – christophetd Oct 22 '15 at 8:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.