I want to be able to create a structure for hosting multiple sites. I want the user files to reside inside /var/www/sites/domain.com and the sftp access to be restricted with chroot.

I've followed some examples on how to set this up, and this is what I've done so far:

Added a new user, set the home directory and group:

useradd foobar -d /var/www/sites/foobar.com -g sftp

Inside /etc/ssh/sshd_config I've added:

Match Group sftp
    X11Forwarding no
    ChrootDirectory %h
    AllowTcpForwarding no
    ForceCommand internal-sftp

and restarted the service

I've configured /etc/vsftpd/vsftpd.conf to include the following changes:




and restarted vsftpd

I've set ownership of /var/www/sites to root and /var/www/sites/foobar.com to foobar

But when I try to connect via sftp using filezilla I get this:

Error:  Authentication failed.
Error:  Critical error: Could not connect to server

Username and password given to filezilla are correct of course

What am I missing?

  • I think you're confusing your SFTP and FTPS. Which do you want to use? SFTP == FTP over SSH (no need for vsftpd), FTPS == FTP over SSL/TLS (no need to touch sshd_config) – fukawi2 Jan 6 '15 at 23:50
  • not the answer but you don't need vsftpd / shouldn't be running it if you're using SFTP over SSH. What port do you run SSH on? Are you running iptables? – user16081-JoeT Jan 7 '15 at 3:37
  • Yes, I got a bit confused. I really just need FTPS, cause I don't want to give user an ssh access, but I'm not sure how would vsftpd know what's the chroot directory without it being specified in sshd_config? – Nicolas Jan 7 '15 at 11:17

Internal-sftp require chrooted user home to reside inside root-owned dir:


Root-owned dir should have 555 permissions and user-dirs should be created by root and owned by specific user. Inside subdirs user can do anything, but he can't delete or rename them.

In your case the good approach is the next:


User's home is the /var/www/sites/foobar.com/

var, www, sites and foobar.com should be root-owned. Also foobar.com should have 555 permissions. data and logs subdirs should be owned by user and permissions should be broad enough to allow httpd access them.

  • 1
    I've changed the ownerships and permissions as you suggested but I'm still getting the same error. – Nicolas Jan 7 '15 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.