I have an FTP server that authenticates via an API and has user folders in:


Some users have requested SFTP instead and since I already have processes in place to put files in the user's directory, I figure I can just create accounts for the users.

useradd -g sftpgroup -d /home/ftpusers/files/username/ -s /sbin/nologin username
mkdir -p /home/ftpusers/files/username/.ssh
chown -R username:ftpgroup /home/ftpusers/files/username
chmod -R 770 /home/ftpusers/files/username
echo "ssh-rsa user key" > /home/ftpusers/files/username/.ssh/authorized_keys
chown username:sftpgroup /home/ftpusers/files/username/.ssh
chmod 700 /home/ftpusers/files/username/.ssh
chown username:sftpgroup /home/ftpusers/files/username/.ssh/authorized_keys
chmod 600 /home/ftpusers/files/username/.ssh/authorized_keys

the ftpgroup is so a system account can place files in the user folder the sftpgroup is to lock this user to just SFTP using:

Match Group sftpgroup
ForceCommand internal-sftp
AllowTCPForwarding no
X11Forwarding no

Unfortunately this doesn't work. No useful error, just:

Permission denied (publickey)

It does work fine though if I create a user in a more standard way in the /home/ directory

Any ideas on why? I know chroot has a lot of permission restrictions. Is this something like that?

Added namei output: Sure thing:

namei -l /home/ftpusers/files/jmandel/.ssh
f: /home/ftpusers/files/jmandel/.ssh
dr-xr-xr-x root    root      /
drwxr-xr-x root    root      home
drwxrwx--- ftpuser ftpgroup  ftpusers
drwxrwx--- ftpuser ftpgroup  files
drwxrwx--- jmandel ftpgroup  jmandel
drwx------ jmandel sftpgroup .ssh

Marked answer below has good information in comment thread

2 Answers 2


Add to your sshd_config file following directive and restart ssh:

AuthorizedKeysFile /home/ftpusers/files/%u/.ssh/authorized_keys .ssh/authorized_keys

This will tell ssh daemon where to look for public keys.

Personally I don't use authorized_keys for a long time, but using instead
AuthorizedKeysCommand where I call my program that looking in sqlite database user's key and send them back for authentication. This way I prevent users/hackers to use their own keys and such configuration don't disclose place where public keys are located.

  • This makes a lot of sense but it didn't seem to work
    – Supergibbs
    Aug 26, 2018 at 4:14
  • @Supergibbs Could you add to your question output of: namei -l /home/ftpusers/files/SomeUserName/.ssh ?
    – Alex
    Aug 26, 2018 at 4:34
  • Sure thing, added above for better formatting
    – Supergibbs
    Aug 27, 2018 at 15:36
  • Check if user jmandel belonging to the group ftpgroup by running id jmandel
    – Alex
    Aug 27, 2018 at 15:48
  • It's not because I don't want it to, that would allow jmandel access to other users folders. There is a user in the ftpgroup that places files in various user folders. As a test though, I added jmandel to ftpgroup and it didn't help
    – Supergibbs
    Aug 27, 2018 at 18:54

Is it really

echo "ssh-rsa user key" > /home/ftpusers/files/username/.ssh/authorized_keys

authorized_keys contains the public key of the people allowed to log in as this userid, so it's different for each userid you create. In theory the users generate their own public/private key pair and give you the public key. You can of course generate the pair yourself and give them the private part, but if anything bad happens they can claim it was done by someone else using their private key.

  • The user provides me with their public key and I use it to create their account
    – Supergibbs
    Aug 26, 2018 at 4:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .