ChrootDirectory is tricky > <

As I google for it and found the ChrootDirectory setting explanation (http://en.wikibooks.org/wiki/OpenSSH/Cookbook/SFTP)

It say " Depending on the opensshd version this may not be usable since some versions require that the chroot-target directory and all parent directories are owned by root and not writeable by any others. "

so in this explanation when I set like this :

drwxr-sr-x 3 root sftp 4096 Mar 9 15:14 www

If I set root:root or root:sftp (chmod is 755) it can use sftp to connect to my /var/www but it don't have writable/deletable permission.

but set www to webmaster:sftp or chmod is 775 can't connect

and this is my user that I want it to control /var/www (It's in the sftp group):


I set this bottom in my sshd_config :

Subsystem sftp internal-sftp

Match group sftp
X11Forwarding no
ChrootDirectory /var/www
AllowTcpForwarding no
ForceCommand internal-sftp

change mod to 775 can't connect >"<

so how can I resolve this problem?

I want my group sftp can have chmod 775 in the /var/www . Can anyone help me?


This seems like a catch-22 situation, but I think I have a way around it.

I recommend not using /var/www to host websites. I treat this directory as system default that is only used if someone visits the server using a servername that doesn't match a vhost.

Instead, host sites in /srv/web, which conforms to the Filesystem Hierarchy Standard. Each site directory (e.g. /srv/web/site1) has the following subdirectories:


Set your vhost's DocumentRoot to /srv/web/site1/htdocs and use the other directories for things that don't need to be web-accessible. Then you can make htdocs (and other subdirectories, if necessary) group-writable. Chroot your sftp to /srv/web/site1 and tell people to upload to the htdocs directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.