I created a new user with no shell access like this:

useradd  -g www -d /www/user01 -p ****** -s /sbin/nologin user01

Then in my sshd_config I add those lines:

AllowUsers user01 user02 manager

Subsystem       sftp    internal-sftp

Match User user01
  ChrootDirectory /www/user01
  PasswordAuthentication yes
  ForceCommand internal-sftp

The problem is I got Access denied every time I log in with putty, is there any misconfiguration?


It appears that the only user can ssh is the root user, even adding the new user to AllowUsers directive.

  • Did you correct /www/user01 owner and permissions? – Glueon Oct 17 '14 at 21:53
  • @Glueon Yes, I chown /www to root:root, and /www/user01 to user01:www, but then I lost readability for nginx without to mention I am still can't login via ssh. – H Aßdøµ Oct 17 '14 at 22:26
  • 1
    Those are not the correct permissions. ChrootDirectory: "Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group." – Mark Wagner Oct 17 '14 at 23:28
  • I am still can't login via ssh. why would you think that you would be able to login with ssh/putty? You have set a force command to only permit sftp clients. – Zoredache Oct 18 '14 at 1:39
  • @Woredache Even removing ForceCommand internal-sftp, or keeping it and login with sftp client WinSCP, it fails. – H Aßdøµ Oct 19 '14 at 16:56

/sbin/nologin is your problem.

You have two options for bash: /bin/bash and /bin/bash (chrooted).

Basically, chrooted bash is for avoiding mishaps.


  • 1
    The authorized used should only able to upload and download files, so a shell is not necessary to grant. – H Aßdøµ Oct 19 '14 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.