Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make ForceCommand internal-sftp and ChrootDirectory /jail the default for all users accessing a server via SSH. Only users in a certain group are allowed to escape this.

How can I exclude a certain group from ForceCommand internal-sftp in a Match block?

It's possible to reset ChrootDirectory by assigning a none value.

Matching the group and settingForceCommand none doesn't work (probably because there is no "none" program), ForceCommand bash works for shell access, but SFTP will no longer work.

share|improve this question
up vote 3 down vote accepted

this works for me with OpenSSH 5.1:

set a restricted default for everyone, but let the staff group have the (unrestricted) defaults.

Match Group *,!staff
        ChrootDirectory /home/ftp
        ForceCommand internal-sftp
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .