0

I've encountered a problem, that I've been messing around since hours now, not understand what is happening. I have read tons of guides on this, which should be a 2 minute setup task on Ubuntu, and I still cannot get it to work.

The problem is:

I've set up the correct sshd_config, at least I hope I did it right...

Subsystem sftp internal-sftp

Match Group sftpusers
ChrootDirectory /var/www
AllowTCPForwarding no
X11Forwarding no
ForceCommand internal-sftp

Both /var /www has the permissions of 755 root:root. Yes I've restarted my ssh service countless times. Yes I've read around 30 stackoverflow posts about stuff like this, but never found anything even closely related to my problem.

Now that I'm through with the prerequisites, here comes the real problem: When I try to connect with an SFTP this is what I see in the auth log:

Nov  8 22:38:07 hidden_server_name sshd[7436]: Accepted password for wordpress_user from imagine_my_hp_address_here port 49508 ssh2
Nov  8 22:38:07 hidden_server_name sshd[7436]: pam_unix(sshd:session): session opened for user wordpress_user by (uid=0)
Nov  8 22:38:07 hidden_server_name systemd: pam_unix(systemd-user:session): session opened for user wordpress_user by (uid=0)
Nov  8 22:38:07 hidden_server_name systemd-logind[1462]: New session 241 of user wordpress_user.
Nov  8 22:38:07 hidden_server_name sshd[7481]: fatal: bad ownership or modes for chroot directory component "/"
Nov  8 22:38:07 hidden_server_name sshd[7436]: pam_unix(sshd:session): session closed for user wordpress_user
Nov  8 22:38:07 hidden_server_name systemd-logind[1462]: Removed session 241.

Naturally, "wordpress_user" is a member of "sftpusers" group, the problem is this line:

Nov  8 22:38:07 hidden_server_name sshd[7481]: fatal: bad ownership or modes for chroot directory component "/"

Why does it want to chroot in to the root directory of the server, when it is clearly set to /var/www?

Even tried changing the home directory several times to all kinds of things of the user.

Someone please relieve me of this headache, it hurts! :D

0
ChrootDirectory /var/www
...
bad ownership or modes for chroot directory component "/"

The ChrootDirectory option requires that the chroot directory and all of its parent directories belong to root. From the documentation (emphasis added):

ChrootDirectory
Specifies the pathname of a directory to chroot(2) to after authentication. At session startup sshd(8) checks that all components of the pathname are root-owned directories which are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.

In your case, the ssh server is complaining about the system's root directory "/". Apparently the root directory has permissions which don't meet these requirements.

The simplest fix would be to adjust the root directory to permissions 0755 and owner root. The only alternative that I know of would be to build your own copy of the SSH server with this check disabled.

  • yes, the logs says that but: "drwxrwxr-x 24 root root 4.0K Nov 9 20:51 ." – FireyFly Nov 9 '18 at 21:38
  • drwxrwxr-x In other words, it has group write permission turned on. That's not permitted. – Kenster Nov 9 '18 at 21:42
  • Already tried setting it to 755 before... was not working, and now it does, unbelievable... Thank you very much sir. – FireyFly Nov 9 '18 at 21:48
0

This is by design.

Strict permissions would force you to populate the /var/www/ directory as root with the files and sub-directories chown'ed to your user or group. That is not optimal.

It is better to create a sub-directory under /var/www/ letting your user write to it, leaving /var/www/ to root.

If you have only one virtual host on the web server, then this is an example to what you can do.

sudo chown root:root /var/www/
sudo chmod u=rwx,g=rx,o=rx /var/www/

sudo mkdir /var/www/site1/
sudo chgrp sftponly /var/www/site1
sudo chmod u=rwx,g=rwxs,o=rx /var/www/site1/

In your SSH server's configuration file add like this:

Match group sftponly
    ChrootDirectory /var/www/
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp -d site1

Source: Reload this Page bad ownership or modes for chroot directory "/var/www".

  • Thank you for trying to help. Sadly still having the same issue :( even in the article you linked as source, the guy is having an error with: "fatal: bad ownership or modes for chroot directory "/var/www"" what I'm having an error with, is "/" even though the chroot directory is set. – FireyFly Nov 9 '18 at 20:48
  • Try maybe to use a folder directly beneath / which obeys the limitation. – harrymc Nov 9 '18 at 20:50
  • Nothing works :( Is there perhaps any setting in the sshd_config that might prevent me from it working? EDIT: I mean there are lots of other settings than these, but is there any that could do this? – FireyFly Nov 9 '18 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.