I'm trying to setup FreeBSD 10 with an account that can SFTP, but not SSH.

I've got my sftponly group and my specific account is a member of that group. My sshd_config contains:

Match Group sftponly
ChrootDirectory /home/account
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

The /home/account is mode 755 with root:sftponly ownership. In this configuration I can login, list the directory, and "get" files but cannot upload files (write permission denied). If I change the account directory to 775 to give the sftponly group write permissions, then the login is blocked. What's the appropriate setup for allowing read AND write SFTP operations with SSH blocked?

  • 1
    Create a separate directory under the chroot with write permissions. – Jakuje Sep 13 '16 at 20:32

Like the comment says OpenSSH is pretty strict about what permissions it allows on chroot directories (for good reasons). So the solution is to have a subfolder with the permissions you want to use for your particular case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.