Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to jail user. I have got these directories:

var/www (root:www-data, 755)         
var/www/web1 (webmaster:www-data, 755)         
var/www/web2 (webmaster:www-data, 755)         

In my ssh_config I have got:

Subsystem sftp internal-sftp

Match User webmaster
  ChrootDirectory /var/www
  ForceCommand internal-sftp

The user can enter the system with the credentials. Also, the user can navigate to var/www, but he cannot access web1 or web2. I don't know why because "webmaster" is the owner of web1 and web2.

Thank you very much. I think that the permissions have been set correctly but I am not an expert in Linux.

share|improve this question

The problem I see in your configuration is that all folders in tree, to where you want to jail user, must be owned (user and group) by root.

In your case it should be:

 /var/www (root:root, 755)
share|improve this answer
Thank you, that is the point. – dlopezgonzalez Mar 15 '13 at 13:35
If my answer helped you to the solution, could you mark it as approved? TY – kovinet May 17 '13 at 15:01

Here's my config, hope it helps.

/var/www (root:root, 755)
/var/www/user1 (user1:sftpusers, 755)
/var/www/user2 (user2:sftpusers, 755)

And my sshd_config:

Subsystem sftp internal-sftp

Match Group sftpusers
  ChrootDirectory /var/www/%u
  ForceCommand internal-sftp
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.