Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to setup a public storage server which allows sftp and rsync (through ssh). I've got it working with a chroot jail and rssh. When the user connects to the server with sftp he can read all the files in the chroot jail (like /lib and /bin) in the chroot. Likewise with rsync (rsync --list-only user@server:/). I would like to have a setup where to user can only view and not leave his home directory.

An additional requirement is that the I don't want to setup a chroot environment for each user.

I already tried the chrootdirectory and forcecommand statements in sshd_config which works great for sftp but does not allow any rsync.

share|improve this question

for the sftp part you might look at the directives Subsystem sftp internal-sftp together with ChrootDirectory in the sshd_config.

share|improve this answer
Already tried that good for sftp but not for rsync – vdrmrt May 3 '13 at 12:16

Did you try to setup commands on the accepted keys as proposed in Trying to setup chroot'd rsync ?


Granting ssh access does not necessarily imply full shell access, for example, this shows how to use the ssh authorized_keys file to allow backup via rsync while limiting available commands to just the rsync receiver.

Something like this, in your authorized_keys file:

command="/usr/bin/rsync --server -a . /tmp/user1" ssh-rsa ... user1
command="/usr/bin/rsync --server -a . /tmp/user2" ssh-rsa ... user2

There's also pointers to two blog articles. The first explains how to restrict ssh to rsync:

The second what you don't want, setting up a chroot environment.

Personally I would go for the chroot and setting $USER/{bin|lib} as bind mounts. This way I would maintain a single chroot environment mounted on every user's chroot.

share|improve this answer
The bind mounts are a good idea but then the user will still be able to see them with rsync, right? – vdrmrt May 18 '13 at 15:28
Can I combine command's in the authorized_keys file to include rsync and sftp? – vdrmrt May 18 '13 at 15:28
re: bind mounts, they would be able to see bin and lib but that shouldn't be a problem, it's only binaries and libs. – itorres May 21 '13 at 17:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.