Is there a way with sftp to have it configured server-side to run a cd command when a client connects?

I have my users thrown in to chroot, the folder has to be root:root chowned and cannot be writable by any other users, there are subfolders owned by the sftp users in the chroot.

What I'd like to do is cd users in to their folders from the server side in the jail when they connect, to avoid the annoyance of having to do so every time they connect. Is this possible?

  • @MartinPrikryl that's what I'm trying to find out. – miethpo Oct 15 '14 at 14:00
  • Sorry that's was a typo. I've meant: Do I understand right you want to force a change directory to a subfolder of the chroot root folder? – Martin Prikryl Oct 15 '14 at 14:01
  • @MartinPrikryl yes. – miethpo Oct 15 '14 at 14:14

OpenSSH uses a program called sftp-server to handle the server side of SFTP sessions. Sftp-server takes an option -d to specify the user's starting directory, as an alternative to their home directory. See the sftp-server man page.

If you're using a typical SFTP chroot jail setup, you probably have a line in your sshd_config:

ForceCommand internal-sftp

This causes sshd to run a copy of the sftp-server code which is built into the sshd program. You can add command-line arguments to this line, just like those for the standalone sftp-server program. So, for example:

Match User jdoe
    ChrootDirectory /var/jdoe-root
    ForceCommand internal-sftp -d /jdoe-homedir

When "jdoe" logs in, he'll be chrooted to /var/jdoe-root, and his starting directory for the session will be /var/jdoe-root/jdoe-homedir.

  • ah! I tried looking for docs on internal-sftp but couldn't find any. I'm able to do something like -d /%u when matching a group, aren't I? – miethpo Oct 16 '14 at 9:16

The SFTP protocol/session is state-less. There's no concept of a working directory with SFTP, contrary to a shell or an FTP. Any illusion of the working directory is simulated by the SFTP client.

So you cannot enforce it server-side.

Note how there's CWD command in FTP protocol (used in the background by cd command of a typical FTP client), but nothing similar in SFTP protocol (really meaning the protocol, not cd command in a typical SFTP client).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.