Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed jailkit on my CentOS 5.8 server, and configured it according to the online guides that I found. These are the commands that were executed as root:

mkdir /var/jail
jk_init -j /var/jail extshellplusnet
jk_init -j /var/jail sftp 
adduser testuser; passwd testuser
jk_jailuser -j /var/jail testuser

I then edited /var/jail/etc/passwd to change the login shell for testuser to be /bin/bash to give them access to a full bash shell via SSH.

Next I edited /var/jail/etc/jailkit/jk_lsh.ini to look like the following (not sure if this is correct)

paths= /usr/bin, /usr/lib/
executables= /usr/bin/scp, /usr/lib/openssh/sftp-server, /usr/bin/sftp

The testuser is able to connect via SSH and is limited to only view the chroot jail directory, and is also able to log in via SFTP, however the entire file system is visible and can be traversed.

SSH Output:

> ssh testuser@server
Last login: Sat Oct 20 03:26:19 2012 from x.x.x.x
bash-3.2$ pwd

SFTP Output:

> sftp testuser@server
Connected to server.
sftp> pwd
Remote working directory: /var/jail/home/testuser

What can be done to lock down SFTP access to the jail?

share|improve this question
up vote 0 down vote accepted

Would love to be corrected if there are problems with this, but the following configuration seems to have worked.

Changed the user in /etc/passwd (not /var/jail/etc/passwd) which had been modified by jailkit:

Original testuser:503:503::/var/jail/./home/testuser:/usr/sbin/jk_chrootsh

Modified testuser:503:503::/home/testuser:/bin/bash

Added configuration to /etc/ssh/sshd_config:

Match Group testuser
        ChrootDirectory /var/jail/

Now when logging in via SSH or SFTP the user is limited to /var/jail and below and defaults to the home directory in /var/jail/home/testuser

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.