Chrooted SFTP user write permissions

We've found a workaround recently that goes like this:

/etc/ssh/sshd_config:

... Subsystem sftp internal-sftp Match Group sftponly ChrootDirectory /home AllowTCPForwarding no X11Forwarding no ForceCommand internal-sftp 

directory permissions:

root@server:~ # chown root:root /home root@server:~ # chmod 111 /home root@server:~ # chmod 700 /home/* 

Now /home satisfies the requirements for ChrootDirectory and can't be listed by restricted users, but sftponly users will not be able to log in if their home directories are set up as usual (/home/$LOGNAME): under the chrooted environment their home directories aren't inside /home but directly under root (/).

workaround 1

Set restricted users' homes to how they appear under chroot:

root@server:~ # usermod -d /username username 

caveate 1

If any of the unrestricted users or some administration script uses bash's tilde expansion like ~username it will expand to /username now, which isn't what is meant.

Also the admin that creates sftponly users has to remember to use non-default home. Solveable with a script. Which the admin has to remember to use.

workaround 2

This is an alternative to the previous one that we ended up using:

root@server:~ # ln -s . /home/home 

That is create a symlink inside /home to its own dirname. Now under chroot /home/username points to the same directory as without chroot. For restricted user logged in with sftp it would appear as /username. This directory is writable to its owner (restricted user). Restricted user can't list its parent or home directories of any of the siblings by name.

The only thing special about an sftponly user is its participation in the sftponly group. We found it easier to deal with than the workaround 1.

caveates 2

1. You can't have user named 'home' with a home directory /home/home
2. You have to be careful with scripts that traverse /home hierarchy and follow symlinks.

You need to create a structure inside the user's home directory, like in and out dirs. Those dirs should be owned by the user and there he will be able to put and get files.

You should create the following directory structure:

/home/user

/home/user/home/user <- the real dir that the user will have access

Optionally:

/home/user/.ssh/authorized_keys <- if you wanna to authenticate with a public key

In reference to the 'directory permissions' section in the answer from @artm (which I just tested) .. I found:

root@server:~ # chmod 111 /home <- Does not work 

It doesn't allow the sftp connection to work on ubuntu with execute only permissions on everything i.e. 111.

I found that:

root@server:~ # chmod 555 /home 

Works with connection to sftp with the Read and Execute permissions i.e. 555. Not sure if debian vs other flavors are different, but that's what works on my ubuntu installs.

When you create a user, you have to set the ownership using chown to every dir for every user.

For example:

sudo chown usertest:groupsftp /home/rootsftp/usertest