Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a very old server (it's kind of embarrassing to write the OS version), but this is the situation, and upgrade OS or ssh is not an option for some reasons.
uname -a > FreeBSD xxx 4.11-STABLE FreeBSD 4.11-STABLE

The problem is that some customer should upload files on a daily basis using sftp, and as far as I know we can't restrict folders using the directive ChrootDirectory due to the old version of ssh:
OpenSSH_3.5p1 FreeBSD-20030924, SSH protocols 1.5/2.0

I have found some alternatives when googling, but most of them includes patching openssh, or installing some other program. We can't install e.g. pureftpd because of the "old" server.

The question:
Is there a way of restricting folders when using OpenSSH_3.5p1, or some other alternative that is easy to install on this server?
I repeat: upgrade OS or ssh is not an option for various reasons.
The situation with the server is that we can't risk that ssh isn't working when restarting, ssh is the only way for us to reach that.

I think it's kind of strange that I couldn't find any "easy" solution to this, there must have been many other that wants to restrict folders, also back in the days when our server was up to date.

share|improve this question
up vote 1 down vote accepted

You could always make a chroot and run sshd inside the chroot, instead of having sshd chroot itself.

In order to do that, you create a separate file system hierarchy, e.g. /chroot/, that contains only the binaries needed to allow login and the libraries those binaries need in order to be executed. You'll also create a passwd, shadow and group file containing the sshd user and so on. You'll probably want to have a separate IP for this user's sshd, or else run it on a separate port.

There's a basic tutorial at about creating a simple chroot.

Since you're running FreeBSD, another option is to use the built-in jail system. I believe the man page will give you all the information you need to set one up - it's basically a chrooted system with some extra bells and whistles, similar to the Solaris zones.

share|improve this answer
Thanks, can you explain that more? I will be happy with a link – 244an Feb 21 '13 at 14:49
I've added some further information. – Jenny D Feb 21 '13 at 15:19
Thanks for pointing me in right direction, I'm a total newbie on this so I didn't even know what to google on. I found some links on chroot jail ftp after reading your answer, and it turned out that this was already set up on the server, but someone had changed the login shell from /sbin/nologin to some login shell, so the "ftp customer" was able to login as a "normal" user :( Don't know if I should add some information if some newbie like me stumble in to this thread, when I first googled I found a lot of questions like mine, without a good answer. Thanks again. – 244an Feb 21 '13 at 19:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.