Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Server: Ubuntu 12.04 LTS

I am using openSSH and have created an SFTP user called bob who belongs to group sftponly. I have chrooted bob to his home directory which is /usr/share/nginx/www/bob/.

bob is able to SFTP onto the server and view is home directory, however he is unable to edit the files in his directory. I have run chown -R bob /usr/share/nginx/www/bob/* to make bob the owner of his files yet he is still unable to edit them.

Why would this be?

share|improve this question
    
I don't mind being downvoted but please tell me why - do you need more information .etc? I'm very new to server admin and it doesn't help my confusion much. –  George Reith Apr 7 '13 at 15:08
    
Chroot SFTP is a pain. I've been dealing with the same types of issues the past week. –  ewwhite Apr 7 '13 at 20:11

1 Answer 1

up vote 5 down vote accepted

To properly chroot an sftponly group member, you need to set this options in /etc/ssh/sshd_config:


Subsystem       sftp    internal-sftp
Match Group sftponly
        ChrootDirectory /srv/chroot/%u
        ForceCommand internal-sftp

It is a requirement that the home directory, and the directories all the way up to the root of the system, of chrooted users must belong to root:root

Given the following values for a user:


$ id user001
uid=1003(user001) gid=1003(user001) groups=1006(sftponly)
$ grep user001 /etc/passwd
user001:x:1003:1003::/input:/sbin/nologin

You need a directory structure like this one:


$ tree /srv/chroot
/srv/chroot
├── user001
│   └── input

Because user001's HOME directory is evaluated after the chroot call, he/she lands in the input directory, where write permissions are valid:


$ ls -lrtd /srv/chroot/user001/input
drwxrwx--- 2 user001 sftponly 4.0K Apr 07 17:55 /srv/chroot/user001/input

share|improve this answer
    
Thanks I had the chroot set up correctly it's just I didn't realise they don't have permissions directly in their chroot directory and need a sub folder. I moved all the files into a sub folder and they can now make changes. –  George Reith Apr 7 '13 at 16:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.