I'm trying to configure a user who will only be able to access to an specific directory. I've configured a Chroot jail in SSH and changed its home directory, but configuring the internal-sftp with chroot the user can't login through sftp client.

SSH config

Subsystem sftp internal-sftp

        Match Group sftpusers
        ChrootDirectory /var/www/latama
        ForceCommand internal-sftp
        X11Forwarding no
        AllowTCPForwarding no

I've did adduser latama sftpusers, to join latama to sfrpusers group.

Changed it's /etc/passwd to


Directory permissions

drwxr-xr-x  8 latama www-data       4096 Nov  5 08:33 latama

And when I try to connect through sftp happens this with verbose mode activated.

[email protected]'s password:
debug1: Authentication succeeded (password).
Authenticated to ourdomain.com ([]:22).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: network
debug1: channel 0: free: client-session, nchannels 1
debug1: fd 0 clearing O_NONBLOCK
Connection to ourdomain.com closed by remote host.
Transferred: sent 1760, received 2316 bytes, in 0.0 seconds
Bytes per second: sent 812187.8, received 1068765.3
debug1: Exit status -1
Connection closed

1 Answer 1


The chroot folder needs to be owned by root, and the write bit should only be set for the owner.

  • Thanks!, It worked fine
    – Zarovich
    Nov 5, 2019 at 14:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .