2

Ubuntu Server 12.04

I need to allow the user offlineuser to upload files to the var/www/mysite/web/ directory only. This directory acts as a site root as well as an upload location (legacy setup).

Within my /etc/ssh/sshd_config file:

With the following commented out , they can upload anywhere. As soon as I uncomment this, they cannot connect at all.

AllowUsers offlineuser ubuntu

Subsystem       sftp    internal-sftp

Match Group sftponly
        ChrootDirectory /var/www/mysite/web/%u       
        ForceCommand internal-sftp
        PasswordAuthentication no
        X11Forwarding no
        AllowTcpForwarding no

offlineuser is a member of sftponly group

This was taken from : Chroot SFTP connection and OpenSSH SFTP chroot() with ChrootDirectory

UPDATE1

:pam_unix(sshd:session): session opened for user offlineuser by (uid=0)

: fatal: bad ownership or modes for chroot directory component "/var/www/mysite/"

: pam_unix(sshd:session): session closed for user offlineuser

So, this is pretty clear , but do I really have to chown the dir to offlineuser? Will that not cause issues if www-data wants to write to it (which is likely?)

  • What's the output of scp -v and the contents of the server log? – mgorven Feb 5 '13 at 17:30
  • ah! good thought. Log output added. – Bob Flemming Feb 5 '13 at 17:35
  • You probably don't need www-data to write to /var/www/mysite, but to some path underneath it, right? – mricon Feb 5 '13 at 17:47
  • technically , the dir that offline user needs to write to is /var/www/mysite/www – Bob Flemming Feb 5 '13 at 17:58
2

From the sshd_config manpage:

Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.

It seems that all parent directories must be only writeable as root, even for SFTP. If this is not possible I would suggest moving the directory elsewhere (e.g. /home/web/offlineuser), and then symlinking/bind-mounting it into place.

1

If you change the chroot directory to be

ChrootDirectory /var/www/mysite/web/

and then give the user a home directory of /testuser in /etc/passwd then you can have /var/www/mysite/web/ correctly owned by root and /var/www/mysite/web/testuser can be owned and writeable by testuser.

  • That's part of the issue, /var/www/mysite/web/ has to be writable by offlineuser. /var/www/mysite/web/offlineuser won't work for this setup due to the amount of legacy stuff going on. – Bob Flemming Feb 6 '13 at 17:25
  • Just move the chroot up a level then and change the home directory for offline user accordingly. – user9517 Feb 6 '13 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.