How do I set up an openssh SFTP server that authenticates against a MySQL table where the users are jailed? Each user will need to have its own jail:

/home/sftp/john /home/sftp/jane etc..

However this is only for the users authenticated through MySQL. These users are also not allowed to use SSH. But users authenticated through pam_unix are allowed to SSH and are not jailed.

I already found out I can do the authentication using the pam-mysql module. But how do I set a jail and disable ssh for these users, while pam_unix users will still have full ssh access.

sshd_config provides tools for chroot, but it chroots to the user's home directory. And sshd_config can disable ssh for groups. But the MySQL users don't have groups and don't have a home directory like a normal linux account.

  • According to the pam-mysql documentation, it basically only manages accountname-password pairs, with no other information about each account. Where is the rest of the information about each account stored? At a minimum, what determines the UID and GID (user ID number and group ID number) for each account?
    – Kenster
    Feb 15, 2015 at 0:00
  • @Kenster I found out libnss-mysql must be used to do this. It will handle retrieving uid, shell, home directory, etc from mysql.
    – Fabian
    Feb 16, 2015 at 12:08
  • 1
    @Fabian did you manage to configure sftp with chroot authenticating against mysql? Could you publish your solution here? Thanks!
    – Marcel
    May 2, 2017 at 15:59


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy