Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need a setup where I can put the contents of several user folders to a DMZ server from where external clients can download it, protocol SFTP, Linux, OpenSSH. To ease administration we want to use one single user for the upload.

What does work is to define ChrootDirectory /home/sftp/ in sshd_config, set the according ownership and modes and define a home dir in passwd so that the working directory of the user fits. This is my structure:


The uploader user can write file1.txt and file2.txt to the corresponding folders and by having the user folders (user1, user2) set to the users' primary group + setting SETGUID on the folders the users are able to even delete the files (which is necessary).

Only problem: because /home/sftp/ is the chroot base dir the users can change updir and see other users' folders, though not being able to change into because of access rights.

Requirement: We want to prevent users to change to /home/sftp/uploader/ and see other users' folders. My requirements are to use SFTP, have one upload user and every user must have write access to his home dir.

Obviously it's not an option to use something like ChrootDirectory %h because every path component of the chroot path needs to have limited access rights, so as far as I understand this does not work.

share|improve this question
up vote 0 down vote accepted

I solved this by introducing another directory level:

          ^^^^^ ^^^^
            |     +- user homedir
            +------- chroot target

OpenSSH is now configured to chroot to the directory "user1" preventing the user from breaking out of his own directory. The user homedir is set to "/data" so that the working directory of the user is this one right after the SFTP login.

"user1" has limited access rights as required by OpenSSH, the user has no write access to this directory.

"data" on the other hand belongs to the user and has his primary group along with SETGUID, so that the user can write in this directory and files that are written by the upload user belong to the correct group.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.