Ubuntu Server 12.04

I need to allow the user offlineuser to upload files to the var/www/mysite/web/ directory only. This directory acts as a site root as well as an upload location (legacy setup).

Within my /etc/ssh/sshd_config file:

With the following commented out , they can upload anywhere. As soon as I uncomment this, they cannot connect at all.

AllowUsers offlineuser ubuntu

Subsystem       sftp    internal-sftp

Match Group sftponly
        ChrootDirectory /var/www/mysite/web/%u       
        ForceCommand internal-sftp
        PasswordAuthentication no
        X11Forwarding no
        AllowTcpForwarding no

offlineuser is a member of sftponly group

This was taken from : Chroot SFTP connection and OpenSSH SFTP chroot() with ChrootDirectory


:pam_unix(sshd:session): session opened for user offlineuser by (uid=0)

: fatal: bad ownership or modes for chroot directory component "/var/www/mysite/"

: pam_unix(sshd:session): session closed for user offlineuser

So, this is pretty clear , but do I really have to chown the dir to offlineuser? Will that not cause issues if www-data wants to write to it (which is likely?)

  • What's the output of scp -v and the contents of the server log?
    – mgorven
    Commented Feb 5, 2013 at 17:30
  • ah! good thought. Log output added. Commented Feb 5, 2013 at 17:35
  • You probably don't need www-data to write to /var/www/mysite, but to some path underneath it, right?
    – mricon
    Commented Feb 5, 2013 at 17:47
  • technically , the dir that offline user needs to write to is /var/www/mysite/www Commented Feb 5, 2013 at 17:58

2 Answers 2


From the sshd_config manpage:

Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.

It seems that all parent directories must be only writeable as root, even for SFTP. If this is not possible I would suggest moving the directory elsewhere (e.g. /home/web/offlineuser), and then symlinking/bind-mounting it into place.


If you change the chroot directory to be

ChrootDirectory /var/www/mysite/web/

and then give the user a home directory of /testuser in /etc/passwd then you can have /var/www/mysite/web/ correctly owned by root and /var/www/mysite/web/testuser can be owned and writeable by testuser.

  • That's part of the issue, /var/www/mysite/web/ has to be writable by offlineuser. /var/www/mysite/web/offlineuser won't work for this setup due to the amount of legacy stuff going on. Commented Feb 6, 2013 at 17:25
  • Just move the chroot up a level then and change the home directory for offline user accordingly.
    – user9517
    Commented Feb 6, 2013 at 17:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .