I have setup a ssh server on debian 7, to use sftp connection.

I chrooted some user, with this config:

Match Group sftpusers
    ChrootDirectory /sftp/%u
    ForceCommand internal-sftp

But if i want login with one of this chrooted users in ssh console, they get logged, but autoclose the connection. In logs I see:

 Oct 17 13:39:32 xxxxxx sshd[31100]: Accepted password for yyyyyy from   zzz.zzz.zzz.zzz port 7855 ssh2
 Oct 17 13:39:32 xxxxxx[31100]: pam_unix(sshd:session): session opened for user yyyyyyyyyyyy by (uid=0)
 Oct 17 13:39:32 d00hyr-ea1 sshd[31100]: pam_unix(sshd:session): session closed for user yyyyyyyyyyyy

How can I chroot a user only for sftp, and use it as a normal user for ssh?

  • 3
    Why on earth would you want to do such a thing? There is literally no point to it. I suspect you are trying to achieve some end effect and have decided this is the right way to do it; I suggest you tell us what you're trying to do, then we can probably be more help to you. – MadHatter supports Monica Oct 17 '13 at 12:20
  • Your comment is not right at all, sometimes corporation have to let users like contractors push data on the server with a specific user but without lets them access the whole server. And NO, you can't always install another layer of services like FTPES etc. For exemple over there, we got a huge Tomcat cluster that each contractor feed by himself on its own home target directory and only can access it over SSH and publickey. So to answer the question, yes it is possible, and as far as I remember, you need to remove ForceCommand internal-sftp. – Dr I Oct 17 '13 at 12:30
  • I have a server, with two websites. Each Website have a owner user, which own all files of websites and the user is also the php pool user of website. I frequently operate on website, with cli script and other, therefore i want avoid to log first as another user in ssh, and after login as a website user for execute scripts. But I also want operate only on chroot enviroiment with sftp to avoid to navigate other folders (Yes, i know this limitation can be bypassed by ssh). – Eghes Oct 17 '13 at 12:34
  • 1
    MadHatter is correct; this restriction doesn't make any sense. ssh by itself can be used to transfer files just as easily as sftp, so restricting the latter but not the former gets you absolutely nothing (except an unnecessarily complicated ssh configuration). – larsks Oct 17 '13 at 13:25
  • 3
    Dr I, let me clarify: chrooted sftp isn't pointless. As you say, one often wants to allow people to transfer data to a server without letting them wander all over it, and chrooted sftp is a good way to do that. But chrooting sftp whilst allowing unchrooted ssh is pointless, since if they want to wander, they'll do it via ssh. Good software generally doesn't make it easy to configure it in ways that are self-defeating, and sshd is no exception. – MadHatter supports Monica Oct 17 '13 at 15:34

From your comment, it appears you want to run scripts as the other user, while restricting that user only to SFTP. To do this, leave your SFTP setup as is. Log in as yourself and do:

sudo -u webuser /usr/bin/somescript.sh

This will run the script "/usr/bin/somescript.sh" as the user "webuser".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.