7

Server: Ubuntu 12.04 LTS

I am using openSSH and have created an SFTP user called bob who belongs to group sftponly. I have chrooted bob to his home directory which is /usr/share/nginx/www/bob/.

bob is able to SFTP onto the server and view is home directory, however he is unable to edit the files in his directory. I have run chown -R bob /usr/share/nginx/www/bob/* to make bob the owner of his files yet he is still unable to edit them.

Why would this be?

Deer Hunter
  • 1,070
  • 7
  • 17
  • 25
George Reith
  • 673
  • 2
  • 12
  • 22
  • I don't mind being downvoted but please tell me why - do you need more information .etc? I'm very new to server admin and it doesn't help my confusion much. – George Reith Apr 07 '13 at 15:08
  • Chroot SFTP is a pain. I've been dealing with the same types of issues the past week. – ewwhite Apr 07 '13 at 20:11

1 Answers1

7

To properly chroot an sftponly group member, you need to set this options in /etc/ssh/sshd_config:


Subsystem       sftp    internal-sftp
Match Group sftponly
        ChrootDirectory /srv/chroot/%u
        ForceCommand internal-sftp

It is a requirement that the home directory, and the directories all the way up to the root of the system, of chrooted users must belong to root:root

Given the following values for a user:


$ id user001
uid=1003(user001) gid=1003(user001) groups=1006(sftponly)
$ grep user001 /etc/passwd
user001:x:1003:1003::/input:/sbin/nologin

You need a directory structure like this one: 


$ tree /srv/chroot
/srv/chroot
├── user001
│   └── input

Because user001's HOME directory is evaluated after the chroot call, he/she lands in the input directory, where write permissions are valid: 


$ ls -lrtd /srv/chroot/user001/input
drwxrwx--- 2 user001 sftponly 4.0K Apr 07 17:55 /srv/chroot/user001/input
dawud
  • 15,096
  • 3
  • 42
  • 61
  • Thanks I had the chroot set up correctly it's just I didn't realise they don't have permissions directly in their chroot directory and need a sub folder. I moved all the files into a sub folder and they can now make changes. – George Reith Apr 07 '13 at 16:05