1

I'm trying to give someone ssh access to a (Ubuntu 14.04) server I've got, but I want to limit them to their own home folder. So I'm trying to follow this tutorial.

I first created a user (sudo adduser jailuser) which made it possible to log in using jailuser. Then proceeding to trying to jail the user, I added the following to /etc/ssh/sshd_config (and restarted ssh):

Subsystem     sftp   internal-sftp
Match Group sftp
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no

I then created the group sftp:

sudo groupadd sftp

and ran the following commands to change the jailuser:

sudo usermod -G sftp jailuser
sudo usermod -s /bin/false jailuser
sudo chown root:root /home/jailuser
sudo chmod 0755 /home/jailuser

The result is that I cannot log in anymore: ssh: connect to host xx.xxx.xx.223 port 22: Connection refused.

Since I'm kind of a newbie with server management I'm lost here. Does anybody know what I'm doing wrong? All tips/tricks are welcome!

Improve this question
4
  • 1
    "Connection refused" means the SSH service isn't responding at all. Check you log for error messages.
    – Daniel B
    Aug 17, 2014 at 9:06
  • 1
    "Connection refused" actually means ssh isn't running at all.
    – Antonis Christofides
    Aug 17, 2014 at 9:08
  • @DanielB It seems you guys are right. With the changes to /etc/ssh/sshd_config ssh doesn't seem to restart correctly. But I copy-pasted it exactly from the tutorial I was following. Any idea what I'm doing wrong there?
    – kramer65
    Aug 17, 2014 at 9:49
  • 1
    It's worth noting that having set their shell to /bin/false, they won't be able to log in via SSH or locally to an actual shell. The tutorial you're using is for restricting SFTP access to a particular directory, for a user that otherwise does NOT have shell access. If this is what you're trying to do, that's fine...but it's not entirely clear that it is or isn't.
    – 0xDAFACADE
    Aug 17, 2014 at 9:51

2 Answers 2

Reset to default
2

I had this issue and the fix was to place "UsePAM yes" above the "Subsystem sftp internal-sftp" stanza. Restart ssh and it worked sraight up.

Improve this answer
1

I don't see anything obviously wrong with the sshd_config lines that you posted. It seems there are three possibilities here:

  1. Nothing is really wrong, but sshd needs to be started.
  2. sshd is able to run, but it's not listening on the right IP address or port.
  3. Something is preventing sshd from starting.

For all of the following, you'd have to be root on the ssh server host.

For (1), Run something like "ps -fe | grep sshd" to see if sshd is running or not. If not, try starting the ssh server. On Ubuntu, you'd run this:

/etc/init.d/ssh restart

If sshd is running, move on to (2). Check sshd_config for the ListenAddress or Port directives. These control which IP address and port the server will listen for connections on. In most cases, you'd leave these commented out (to use the default values) or set them to 0.0.0.0 and 22, respectively.

If you've tried to start sshd and it won't run, then start by checking the log files in /var/log for any messages from sshd. They may indicate what problem it's having. If that doesn't pan out, you can run sshd interactively with debugging:

/usr/sbin/sshd -ddd            # Listen on the default port 22
/usr/sbin/sshd -ddd -p 1022    # Listen on port 1022

sshd will stay connected to your terminal and print a bunch of debugging information. If it can't keep running for some reason, it ought to tell you why.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .