Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ubuntu Server 12.04

I need to allow the user offlineuser to upload files to the var/www/mysite/web/ directory only. This directory acts as a site root as well as an upload location (legacy setup).

Within my /etc/ssh/sshd_config file:

With the following commented out , they can upload anywhere. As soon as I uncomment this, they cannot connect at all.

AllowUsers offlineuser ubuntu

Subsystem       sftp    internal-sftp

Match Group sftponly
        ChrootDirectory /var/www/mysite/web/%u       
        ForceCommand internal-sftp
        PasswordAuthentication no
        X11Forwarding no
        AllowTcpForwarding no

offlineuser is a member of sftponly group

This was taken from : Chroot SFTP connection and OpenSSH SFTP chroot() with ChrootDirectory


:pam_unix(sshd:session): session opened for user offlineuser by (uid=0)

: fatal: bad ownership or modes for chroot directory component "/var/www/mysite/"

: pam_unix(sshd:session): session closed for user offlineuser

So, this is pretty clear , but do I really have to chown the dir to offlineuser? Will that not cause issues if www-data wants to write to it (which is likely?)

share|improve this question
What's the output of scp -v and the contents of the server log? – mgorven Feb 5 '13 at 17:30
ah! good thought. Log output added. – Bob Flemming Feb 5 '13 at 17:35
You probably don't need www-data to write to /var/www/mysite, but to some path underneath it, right? – mricon Feb 5 '13 at 17:47
technically , the dir that offline user needs to write to is /var/www/mysite/www – Bob Flemming Feb 5 '13 at 17:58

From the sshd_config manpage:

Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.

It seems that all parent directories must be only writeable as root, even for SFTP. If this is not possible I would suggest moving the directory elsewhere (e.g. /home/web/offlineuser), and then symlinking/bind-mounting it into place.

share|improve this answer

If you change the chroot directory to be

ChrootDirectory /var/www/mysite/web/

and then give the user a home directory of /testuser in /etc/passwd then you can have /var/www/mysite/web/ correctly owned by root and /var/www/mysite/web/testuser can be owned and writeable by testuser.

share|improve this answer
That's part of the issue, /var/www/mysite/web/ has to be writable by offlineuser. /var/www/mysite/web/offlineuser won't work for this setup due to the amount of legacy stuff going on. – Bob Flemming Feb 6 '13 at 17:25
Just move the chroot up a level then and change the home directory for offline user accordingly. – Iain Feb 6 '13 at 17:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.