I need some help on this.

I'm attempting to jail SSH users into their own folders so that they can SFTP into a server without seeing the filesystem

I have following a simple guide online and managed to jail a user into their default home folder (/home/user). However if I attempt to change their home folder the user cannot log in.

I have 2 users: kevin and default

cat /etc/passwd reveals


and my sshd_config file looks like

Subsystem sftp internal-sftp

Match Group sftponly
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

and cat /etc/group reveals


Does anyone know why the user kevin works as expected, but the user default is unable to login.



I've edited my passwd file and change default:x:501:500::/var/www/vhosts/default:/bin/false to default:x:501:500::/home/default:/bin/false and the default user can now login.

The problem only seems to happen if I want to change the user's home to /var/www/vhosts/user

  • 1
    Are they being blocked by SELinux? Do setenforce 0 to temporarily disable it. – Safado Sep 23 '13 at 13:38
  • Seems that is the issue. Is it safe to setenforce 0? – Dotty Sep 23 '13 at 13:43
  • SELinux is an extra layer of security. So you'll be less safe without it. I see it as a benefit to have, but it takes time to learn. I'll migrate this to an answer. – Safado Sep 23 '13 at 14:11

I'm guessing it's SELinux that's blocking it.

To temporarily disable it to see if it's the problem, do setenforce 0 to set it to permissive mode. It will turn back on after a reboot or by switching the flag back to 1.

To permanently set it into permissive mode, edit /etc/selinux/config and set SELINUX=permissive. Where this is a target machine for end users, I suggest keeping it turned on. Install a suite called setroubleshoot and find some guides on how to use the sealert command bundled with it. It tries to intelligently make suggestions for you on how to handle items that are being blocked by SELinux. It also writes and compiles the policies for you, so it's pretty beginner friendly.

  • If setenforce 0 is only a temporary solution, what would be a permanent solution? – Dotty Sep 23 '13 at 14:33
  • Edit the /etc/selinux/config file and set SELINUX=permissive. That'll put it in permissive mode at boot time. – Safado Sep 23 '13 at 14:37
  • Sorry, yes I saw that. But you then go on to say that you suggest keeping it turned on if it's an end user machine. That means that there must be a better solution. – Dotty Sep 23 '13 at 14:39
  • Oh, I see what you're saying. Well thats the nice thing about permissive mode is that SELinux is still running and logging actions, but it doesn't actually block anything. So I suggest put it in permissive mode for now just to get your system running like you want it, then use sealert to build policies that will allow the user to have a non traditional home directory. Once the problem has been remedied via the appropriate policies, set SELinux back to enforcing mode. – Safado Sep 23 '13 at 14:42

Not only the user's home directory but all its components should be owned by root. In your case, this includes all these directories: {/var, /var/www, /var/www/vhosts/default, /var/www/vhosts/default}. Additionally, these directories can't be writable by any other users or groups.

Finally, if you have selinux running in enforcing mode please make sure that user's home directory has correct context set. The simplest way to do this is to use chcon tool (non-persistent change) or with semanage (persistent change).

  • all the folders /var /var/www /var/www and /var/www/vhosts are all owned by root (drwxr-xr-x. 18 root root) – Dotty Sep 23 '13 at 13:34
  • I think it's selinux related. Try to switch it from enforcing to permissive mode with setenforce 0. Further, check /var/log/secure log file for warnings/errors. – dsmsk80 Sep 23 '13 at 13:40
  • You are absolutely right. setenforce 0 seemed to do this trick. What does this command do? – Dotty Sep 23 '13 at 13:42

The user home directory should be owner by root

  • If i run ls -l /var/www/vhosts I get drwxr-xr-x. 3 root root 4096 Sep 23 12:07 default which implies it is owned by root. :( – Dotty Sep 23 '13 at 13:29
  • Use LogLevel DEBUG in your sshd_config and see what happen – c4f4t0r Sep 23 '13 at 13:35
  • What makes you think this? – voretaq7 Sep 23 '13 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.