Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make ForceCommand internal-sftp and ChrootDirectory /jail the default for all users accessing a server via SSH. Only users in a certain group are allowed to escape this.

How can I exclude a certain group from ForceCommand internal-sftp in a Match block?

It's possible to reset ChrootDirectory by assigning a none value.

Matching the group and settingForceCommand none doesn't work (probably because there is no "none" program), ForceCommand bash works for shell access, but SFTP will no longer work.

share|improve this question
up vote 3 down vote accepted

this works for me with OpenSSH 5.1:

set a restricted default for everyone, but let the staff group have the (unrestricted) defaults.

Match Group *,!staff
        ChrootDirectory /home/ftp
        ForceCommand internal-sftp
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.