Decided to re-phrase the question entirely in order to not have to make a new one.

I currently have an SFTP server set up using OpenSSH's SFTP functionality. All my users are chrooted, and everything works.

What I need most right now is for one user, which is not root (because this user can't have any real SSH powers!), to have access to all other users' chrooted dirs. This user's job is to fetch all uploaded documents every once in a while.

Directory structure as of now is:

/home |_ /home/user1 |_ /home/user2 |_ /home/user3

With ChrootDirectory set as /home/%u

User "adminuser" should have access to user1, user2 and user3's directories without having access to /home or at the very least not to anything but /home.

Bonus points for the one who can tell me how to let users write inside /home/%u without having to make a new directory inside that dir which they own themselves, and not root as is the case with /home/%u (openssh chroot prerequisite).


Create a new home directory, such as /chroothome.

Have all users home directories live within that chroothome.

chroot adminuser to /chroothome.

For everything else, just use filesystem permissions.

As far as your "bonus question," it isn't possible using native functionality. The inability for the chroot user to write to the root directory is a security mechanism by design. Of course, you can always modify the source code.

Nevertheless, I suspect you could specify the user's home directory as /user1 and have the working directory at login be the one they could write to.

  • The thing is, if you have a structure like that the chroot functionality will complain or most likely even refuse to work because the /chroothome where the user dir's reside isn't root owned, right? – HannesFostie May 17 '10 at 7:22
  • Why wouldn't it be root owned? – Warner May 17 '10 at 13:50
  • Cause if it is, adminuser won't be able to access it? – HannesFostie May 18 '10 at 13:35
  • It would be able to if the permissions were 711 or 755. – Warner May 18 '10 at 14:06

In your /etc/ssh/sshd_config add these lines:

Subsystem sftp internal-sftp

Match group SFTP-users
     ChrootDirectory /home/%u
     X11Forwarding no
     AllowTcpForwarding no
     ForceCommand internal-sftp

Then change owner of the user home directory

# chown root.root /home/user
# usermod -d / user
# adduser user SFTP-users

Restart ssh server daemon

#/etc/init.d/sshd restart
  • This is exactly what I have right now, except for a different home dir for the user. Whether the home dir is / or /home/<user>, it does not change a thing and doesn't help me in my situation I'm afraid. – HannesFostie May 4 '10 at 13:41
  • @HannesFostie Make me understand. You've made those changes, restarted sshd and when you ssh with the specified user you are not chrooted? Which distribution are you using? – Federico Fenara May 4 '10 at 14:22
  • Those are the settings I was already using before you made your post. I believe the chroot works, as I cannot actually see any directories outside of the chroot, but I am required to create a subdirectory inside the chroot for the user to upload files in. So the user can't upload files in what appears to be, to him anyway, the root. – HannesFostie May 4 '10 at 14:34
  • To make it more clear: consider the following directory: /home/foo/bar. The user foo can log in and will see /bar. He can write inside /bar but not in /. I want him to be able to write in /, and have the files that are currently residing in / (.bash_logout, .bashrc and .profile) either invisible or moved away – HannesFostie May 4 '10 at 14:36
  • Maybe you can try # chown root.SFTPusers /home/user # chmod g+w /home/user so the user, being part of the group, can have write access to the dir and the other users of the group cannot (being jailed on their home dir) Is that viable? – Federico Fenara May 4 '10 at 15:40

1°) Sshd checks that home directory is owned by the user who logged in. 2°) if you use chroot, sshd checks that every directory parent to the home is owned by root ( http://www.tenshu.net/archives/2008/10/09/openssh-51-chrootdirectory-permissions-issue/ )

If you want to chroot a user and let him read chroot for other users, the home of this user has to be a parent directory of the chroot of these user. Because of that you will broke one the the two previous rules.

AFAIK, the only solution would be to patch sshd :-)

  • Would using symlinks solve this? Use /home/%u for the regular dirs, then create a symlink for each of them somewhere else, and chroot the admin user to that dir. What about writing in the root of the homedir? Is that possible at all? – HannesFostie May 12 '10 at 7:34
  • no... sshd will also check if /home/%u is a directory :-) Maybe you can test with something like using a $HOME like /home2/privilegied_user_name and mount --bind /home /home2/privilegied_user_name/other_homes but... not very nice ... – aligot May 12 '10 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.