Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running an Ubuntu 12.04.1 LTS (GNU/Linux 3.2.0-30-generic x86_64) Server, with OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012.

I'd like to configure chroot for sftp access using settings in /etc/ssh/sshd_config, with key based authentication.

I've followed the tutorial here:

That tutorial helped me get sftp working with password authentication. I've modified the /etc/ssh/sshd_config file and copied the keys to try to get key based authentication working, but so far, no luck.

Relevant parts of my /etc/ssh/sshd_config file:

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes
# Of course, I'd like to change this to no once key-based auth is working

# Commenting for chroot use
#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem       sftp    internal-sftp

Match Group sftpusers
        ChrootDirectory /sftp/%u
        ForceCommand internal-sftp
        PubkeyAuthentication yes
        AuthorizedKeysFile     %h/.ssh/authorized_keys

I've put the key in /sftp/testuser/incoming/.ssh/authorized_keys and experimented a bit by putting it in different directories. I've ensured that the rights are 600 on the authorized_keys file and that testuser owns it:

-rw------- 1 testuser sftpusers  616 Sep 21 09:20 authorized_keys

Here's the entry in /etc/passwd for the testuser:

share|improve this question

Put your keys outside chroot (they are used before chroot any way). For example put your keys in /etc/ssh-pool/ and change you config:

AuthorizedKeysFile /etc/ssh-pool/

share|improve this answer
Thanks RJS. I'm working on getting it going as you describe. – Ted LeRoy Sep 24 '12 at 0:52
Thanks, you helped me a lot! Was looking for the answer for few hours, only your suggestion helped! Thanks again! – kajman Oct 23 '12 at 11:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.