1

I am trying to create a new SFTP account for my server. When I follow these instructions exactly, then everything works fine: https://www.thegeekstuff.com/2012/03/chroot-sftp-setup/

I can connect with the guestuser user via sftp, browse my home directory, and go one level up from incoming into /sftp/guestuser.

I can even change the ChrootDirectory value in /etc/ssh/sshd_config to specifically be /sftp/guestuser, instead of implementing the %u parameter. So hardcoded directory names therefore work fine.

But from that point, if all I do is change the ChrootDirectory of my sftpusers group to my actual website's directory on /var/www/www.example.com, then I cannot connect via the sftp command on that user anymore. The shell outputs:

Connection to www.example.com closed by remote host. Couldn't read packet: Connection reset by peer

I definitely did:

  1. Make sure I had the incoming folder in my /var/www/www.example.com directory
  2. Set the ownership of both /var/www/www.example.com and /var/www/www.example.com/incoming to guestuser:sftpusers
  3. Tried setting the home directory of user to / by doing usermod guestuser -d /

The /sftp/guestuser directory (the one with which it worked) is in the ownership of root:root, so the fact that the permissions of /var/www are on root:root should not matter(?)

How come I cannot change the home directory of my new SFTP user?

UPDATE

I can change the directory to:

  • /sftp
  • /
  • /var
  • /var/www

Those all work. But as soon as go one more under /var/www, like /var/www/test, it doesn't work. I've tried removing the dots from the original directory name that was www.example.com, but it didn't make a difference.

It's not about a limit on the number of subdirectory levels either, because /sftp/guestuser/incoming also worked. Testing it with a new directory /web/www.example.com did not.

1

Okay, so I've managed to pinpoint the cause. The directory that i define as the ChrootDirectory for the user must be owned by root.

If i want my user to be able to upload stuff (which obviously he won't be able to do in a root-owned one), then i need to create a subdirectory in there, and set that directory as his home via the -d parameter when creating or editing the user.

If at any point the ownership is changed so that the ChrootDirectory is owned by that user that is trying to ftp into it, the broken pipe message will appear again. Changing the ownership back to root, and the user can connect again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy