I use proFTPD on debian 8. For some reasons i need users that can only access to their documentroot. I already configured this and it works but only when i connect in FTP.

If the user connect on SFTP, he will be able to access at the entire FTP.

How can i do ?


I found how to correct my problem.

1) I stoped proFTD because it cause problems. I swich on the default SSH server od my debian server

2) All of the folders are owned by root:root and with 755 perms. In my case, it was /, /var, /var/www, and /var/www/dev

3) The SSHD config was :

Subsystem sftp internal-sftp Match Group dev ChrootDirectory /var/www/dev ForceCommand internal-sftp AllowTcpForwarding no

  • Are you sure SFTP is provided by proFTPD and not sshd? – Piotr P. Karwasz Mar 8 at 18:39
  • Yes it was this ! – Mathéo Tichy Mar 8 at 20:06
  • But how can i install a limit of defaut root for sshd ? – Mathéo Tichy Mar 8 at 20:06

If you want to restrict some SFTP users to a subdirectory of your filesystem, you can use the ChrootDirectory option in your OpenSSH server config.

Let's assume you want restrict the users of group ftp-users to access only the /var/ftp/%username% directory (where %username% is their username). Then you could use:

Subsystem sftp internal-sftp
Match group ftp-users
    ChrootDirectory /var/ftp/%u

In the ChrootDirectory option you can use %u for the username, %U for the user id or %h for the user's home directory.

| improve this answer | |
  • Thanks for you reply. But in my case, it doesn't work. This is my config : Match Group dev ChrootDirectory /var/www/dev ForceCommand internal-sftp AllowTcpForwarding no – Mathéo Tichy Mar 8 at 21:09
  • The config looks alright. Did you restart the ssh server? What are the logs saying? – Piotr P. Karwasz Mar 8 at 21:15
  • Yes i restarted the server at every modification. I look at /var/log and didn't found auth.log It is normal ? – Mathéo Tichy Mar 8 at 21:18
  • It depends on /etc/rsyslog.conf, but usually facility auth and authpriv are logged to /var/log/auth.log. You can also try journalctl -u ssh. Regarding the config: only the first matching Match stanza is applied, maybe you have several. – Piotr P. Karwasz Mar 8 at 21:22
  • Hello, I have tried your configuration but it doesn"t work. In my logs there is : fatal: bad ownership or modes for chroot directory component "/var/www/dev/" But i gave root:root to the folder and 777 for the perms. – Mathéo Tichy Mar 14 at 9:45

In order to make a secure connection to a FTP server, you can use any application that support SFTP. SFTP (commonly referred to as Secure File Transfer Protocol ) can perform secure file transfers.

| improve this answer | |
  • Yes, i do that but how can i desactivate SFTP on proFTPD ? – Mathéo Tichy Mar 8 at 16:50
  • imho proftp is delivering ftps and not sftp, this are 2 different protocol handlings the first works with ftp over ssl/tls and the other on 22 ssh – djdomi Mar 15 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.