I have this setup in sshd_config:

AllowUsers test1 test2

Match group sftpgroup
         ChrootDirectory /var/www
         X11Forwarding no
         AllowTcpForwarding no
         ForceCommand internal-sftp

Match user test2
         ChrootDirectory /var/www/somedomain.dk
         X11Forwarding no
         AllowTcpForwarding no
         ForceCommand internal-sftp

I am trying to restrict test2 to only use /var/www/somedomain.dk

For some reason when I try to login e.g. with Filezilla on account test2 I get this error: "Server unexpectedly closed network connection"

The users are created and works. the SSH service has been stopped and started. test1 works when using e.g. filezilla and the root of the connection is /var/www. What am I doing wrong?


If the answer Cudos supplied does not help you, and I dont think it will (no offense), try this:

chown root:root /your/chroot/home
chmod 700 /your/chroot/home
chown user:sftpgroup /your/chroot/home/userdir
chmod 755 /your/chroot/home/userdir

remember: your users wont be able to write in their "root", you need to create a directory for them to use.


Thanks for bringing this feature of SSH to my attention.

The following Debian Administration article states that the target directory must be owned by root - perhaps /var/www/somedomain.dk is not.


  • yeah, thanks for showing me too. this kind of config for sftp is new to me also... "Specifying a command of ``internal-sftp'' will force the use of an in-process sftp server that requires no support files when used with ChrootDirectory." – djangofan Apr 23 '10 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.