I need a setup where I can put the contents of several user folders to a DMZ server from where external clients can download it, protocol SFTP, Linux, OpenSSH. To ease administration we want to use one single user for the upload.

What does work is to define ChrootDirectory /home/sftp/ in sshd_config, set the according ownership and modes and define a home dir in passwd so that the working directory of the user fits. This is my structure:


The uploader user can write file1.txt and file2.txt to the corresponding folders and by having the user folders (user1, user2) set to the users' primary group + setting SETGUID on the folders the users are able to even delete the files (which is necessary).

Only problem: because /home/sftp/ is the chroot base dir the users can change updir and see other users' folders, though not being able to change into because of access rights.

Requirement: We want to prevent users to change to /home/sftp/uploader/ and see other users' folders. My requirements are to use SFTP, have one upload user and every user must have write access to his home dir.

Obviously it's not an option to use something like ChrootDirectory %h because every path component of the chroot path needs to have limited access rights, so as far as I understand this does not work.


I solved this by introducing another directory level:

          ^^^^^ ^^^^
            |     +- user homedir
            +------- chroot target

OpenSSH is now configured to chroot to the directory "user1" preventing the user from breaking out of his own directory. The user homedir is set to "/data" so that the working directory of the user is this one right after the SFTP login.

"user1" has limited access rights as required by OpenSSH, the user has no write access to this directory.

"data" on the other hand belongs to the user and has his primary group along with SETGUID, so that the user can write in this directory and files that are written by the upload user belong to the correct group.


As I understand I should use Match user for every user separately in sshd_config

Match user user1
ChrootDirectory /srv/sftp/user1
Match user user2
ChrootDirectory /srv/sftp/user2
AllowTCPForwarding no
X11Forwarding no
ForceCommand internal-sftp

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.