1

I'm trying to configure a user who will only be able to access to an specific directory. I've configured a Chroot jail in SSH and changed its home directory, but configuring the internal-sftp with chroot the user can't login through sftp client.

SSH config

Subsystem sftp internal-sftp

        Match Group sftpusers
        ChrootDirectory /var/www/latama
        ForceCommand internal-sftp
        X11Forwarding no
        AllowTCPForwarding no

I've did adduser latama sftpusers, to join latama to sfrpusers group.

Changed it's /etc/passwd to

latama:x:1002:1003:,,,:/var/www/latama:/bin/nologin

Directory permissions

drwxr-xr-x  8 latama www-data       4096 Nov  5 08:33 latama

And when I try to connect through sftp happens this with verbose mode activated.

latama@ourdomain.com's password:
debug1: Authentication succeeded (password).
Authenticated to ourdomain.com ([175.75.145.125]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: channel 0: free: client-session, nchannels 1
debug1: fd 0 clearing O_NONBLOCK
Connection to ourdomain.com closed by remote host.
Transferred: sent 1760, received 2316 bytes, in 0.0 seconds
Bytes per second: sent 812187.8, received 1068765.3
debug1: Exit status -1
Connection closed

0

The chroot folder needs to be owned by root, and the write bit should only be set for the owner.

1
  • Thanks!, It worked fine – Zarovich Nov 5 '19 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.