How can chroot sftp-only SSH users into their homes?
Here is a guide for setting up SFTP users who’s access is restricted to their home directory.
/etc/ssh/sshd_config
|
1 2 3 4 5 6 7 8 |
# Enable sftp Subsystem sftp internal-sftp # This section must be placed at the very end of sshd_config Match Group sftponly ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no |
|
1 2 3 4 5 6 7 8 9 10 11 |
# Create sftponly group groupadd sftponly # Add a user to sftponly group usermod {username} -g sftponly # Deny SSH shell access usermod {username} -s /bin/false # Set the user's home directory usermod {username} -d {home_directory} # Restart SSH service service ssh restart |
Notes: (Important!)
If you got the login failed message:
Write failed: Broken pipe
Change the user and access permission:
|
1 2 3 4 |
chown root:sftponly /home chown root:sftponly /home/{username} chmod 755 /home chmod 755 /home/{username} |