I want to setup a public storage server which allows sftp and rsync (through ssh). I've got it working with a chroot jail and rssh. When the user connects to the server with sftp he can read all the files in the chroot jail (like /lib and /bin) in the chroot. Likewise with rsync (rsync --list-only user@server:/). I would like to have a setup where to user can only view and not leave his home directory.

An additional requirement is that the I don't want to setup a chroot environment for each user.

I already tried the chrootdirectory and forcecommand statements in sshd_config which works great for sftp but does not allow any rsync.

2 Answers 2


for the sftp part you might look at the directives Subsystem sftp internal-sftp together with ChrootDirectory in the sshd_config.

  • Already tried that good for sftp but not for rsync
    – vdrmrt
    May 3, 2013 at 12:16

Did you try to setup commands on the accepted keys as proposed in Trying to setup chroot'd rsync ?


Granting ssh access does not necessarily imply full shell access, for example, this shows how to use the ssh authorized_keys file to allow backup via rsync while limiting available commands to just the rsync receiver.

Something like this, in your authorized_keys file:

command="/usr/bin/rsync --server -a . /tmp/user1" ssh-rsa ... user1
command="/usr/bin/rsync --server -a . /tmp/user2" ssh-rsa ... user2

There's also pointers to two blog articles. The first explains how to restrict ssh to rsync:

The second what you don't want, setting up a chroot environment.

Personally I would go for the chroot and setting $USER/{bin|lib} as bind mounts. This way I would maintain a single chroot environment mounted on every user's chroot.

  • The bind mounts are a good idea but then the user will still be able to see them with rsync, right?
    – vdrmrt
    May 18, 2013 at 15:28
  • Can I combine command's in the authorized_keys file to include rsync and sftp?
    – vdrmrt
    May 18, 2013 at 15:28
  • re: bind mounts, they would be able to see bin and lib but that shouldn't be a problem, it's only binaries and libs.
    – itorres
    May 21, 2013 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.