Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For a user group I'd like to:

  • Restrict SFTP access to a given directory
  • Use a custom shell for TTY which takes care of only exposing what needs to be exposed from the system but that still need access to the entire root file system

So ultimately I'd like to perform and ChrootDirectory only for users from a certain group but also connected over a sftp session and avoid doing a ChrootDirectory for users connected over a TTY session. Can it be done through sshd_config?


share|improve this question
I dont think this is possible without connecting on differnt ports / differnt users – exussum Dec 15 '13 at 16:33

Do you need shell access?

If not then take a look at an sftponly setup. It is configurable per user or per group and uses chown to restrict sftp access to one directory.

share|improve this answer
Yes shell access is required. The idea is to have a limited functionality command line interface (custom, obviously not sh or bash) with full access to the file system underneath. This is not possible after the ChrootDirectory. Yet when the same user launch a sftp session I'd like to limit its access to a given directory (I don't believe there's a clean way to do that besides using ChrootDirectory) – user3101309 Dec 15 '13 at 21:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.