54

I created the user MY_USER. Set his home dir to /var/www/RESTRICTED_DIR, which is the path he should be restricted to. Then I edited sshd_config and set:

Match user MY_USER
  ChrootDirectory /var/www/RESTRICTED_DIR

Then I restarted ssh. Made MY_USER owner (and group owner) of RESTRICTED_DIR, and chmodded it to 755. I get

Accepted password for MY_USER
session opened for user MY_USER by (uid=0)
fatal: bad ownership or modes for chroot directory component "/var/www/RESTRICTED_DIR"
pam_unix(sshd:session): session closed for user MY_USER

If I removed the 2 lines from sshd_config the user can login successfully. Of course it can access all the server though. What's the problem? I even tried to chown RESTRICTED_DIR to root (as I read somewhere that someone solved this same problem doing it). No luck..

68

From the man page:

ChrootDirectory
Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.

My guess is one or more of the directories on the path do not meet those requirements (my suspicion is www is owned or writable by your web user, not root).
Go back and follow the directions, ensuring that the requirements above in bold italics are met.

  • This is driving me mad. I did "chown root:root -R /var/www" ; "chmod 775 -R /var/www/" ; "usermod -a -G root www-data". But I still can't login with MY_USER – MultiformeIngegno Mar 27 '14 at 22:30
  • 1
    The requirement is on the Path Components (/, /var, /var/www, and /var/www/RESTRICTED_DIR must all meet the security requirements above). It is a true chroot (review the man page) - your user's home directory needs to exist within the chroot, as must /bin & all the other things your user will need... – voretaq7 Mar 28 '14 at 0:03
  • 2
    Ok! Solved. I set the chrooted dir a level up. Then I gave 777 perms to the original chrooted_dir. It's working :) – MultiformeIngegno Mar 30 '14 at 18:34
  • 1
    Despite what the manpage says, and even with the group set to 'root', I had to set g-w permission before it would work (Ubuntu 14.04). The manpage should say All components of the pathname must be root-owned directories that are not writable by any other user or any group at all sudo chown root:root -R /path/to/home; sudo chmod 755 -R /path/to/home – mmell Jan 15 '15 at 23:32
  • 3
    I know this is quite old, but instead of modifying the permissions for the /var/www path directly, which might break apache, you'd be far better off putting your sftp directory in another path, then using URL mapping in Apache to point to the other directory. Check the documentation here httpd.apache.org/docs/2.4/urlmapping.html under Files Outside DocumentRoot – Daniel Sep 3 '16 at 2:58
31

ChrootDirectory directory must be owned by root and have 755 mode:

sudo chown root:root /var/www/RESTRICTED_DIR
sudo chmod 755 /var/www/RESTRICTED_DIR

Ok, now all files into /var/www/RESTRICTED_DIR must be owned by MY_USER, which must belong to www-data group, and have 775 mode to allow group permissions, like this:

sudo usermod -a -G www-data MY_USER
sudo chown MY_USER:www-data /var/www/RESTRICTED_DIR/*
sudo chmod 775 -R /var/www/RESTRICTED_DIR/*

NOTE: Remember is a good practice allow access only to an htdocs folder if you are configuring apache.

  • 3
    Pretty sure it should be sudo usermod -a -G www-data MY_USER as the group should come after -G – sMyles Dec 21 '16 at 17:28
  • This works but I cannot upload new files to the directory, I only can modify files created before with root account and with the user ownership. – dlopezgonzalez Jan 31 at 12:29
3

After some troubleshooting today, I realized that root must also be able to write to the directories.

The following did not work:

$ ls -ld /mnt/synology03/files/
dr-xr-xr-x 1 root root 156 Oct  8 20:10 /mnt/synology03/files/
$ ls -ld /mnt/synology03
drwxr-xr-x 7 root root 4096 Oct  1 21:26 /mnt/synology03
$ ls -ld /mnt
drwxr-xr-x 6 root root 4096 Feb  8 10:01 /mnt
$ ls -ld /
drwxr-xr-x 24 root root 4096 Jan 14 09:22 /

As soon as I fixed this, my chroot started working.

$ sudo chmod 755 /mnt/synology03/files/
$ ls -ld /mnt/synology03/files/
drwxr-xr-x 1 root root 156 Oct  8 20:10 /mnt/synology03/files/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.