Skip to main content
Unix & Linux

Return to Answer

deleted 7 characters in body; added 72 characters in body
Source Link
Sora Minazuki
Sora Minazuki
  • 231
  • 1
  • 3

You can set the chroot location differently for each user like this:

Match User a Configuration for user a Match User b Configuration for user b

OpenSSH's SFTP subsystem refuses to chroot into any directory not owned by root for security reasons, so you can't make new files right under the chroot directory unless you're root. By changing your user id to 0, you effectively became root, which is an extremely BAD idea. By becoming root, not only can your user escape the chroot jail, your user gained permission to do anything on your system, which is againstviolating the principal of least privilege. I would strongly recommend that you change your user id back to normal.

If you were choosing to use chrooted SFTP for better security, I also doubt that it's an effective choice, because chroot was not designed designed for security and there are many ways known to get around it.

You can set the chroot location differently for each user like this:

Match User a Configuration for user a Match User b Configuration for user b

OpenSSH's SFTP subsystem refuses to chroot into any directory not owned by root for security reasons, so you can't make new files right under the chroot directory unless you're root. By changing your user id to 0, you effectively became root, which is an extremely BAD idea. By becoming root, not only can your user escape the chroot jail, your user gained permission to do anything on your system, which is against the principal of least privilege.

If you were choosing to use chrooted SFTP for better security, I also doubt that it's an effective choice, because chroot was not designed designed for security and there are many ways known to get around it.

You can set the chroot location differently for each user like this:

Match User a Configuration for user a Match User b Configuration for user b

OpenSSH's SFTP subsystem refuses to chroot into any directory not owned by root for security reasons, so you can't make new files right under the chroot directory unless you're root. By changing your user id to 0, you effectively became root, which is an extremely BAD idea. By becoming root, not only can your user escape the chroot jail, your user gained permission to do anything on your system, violating the principal of least privilege. I would strongly recommend that you change your user id back to normal.

If you were choosing to use chrooted SFTP for better security, I also doubt that it's an effective choice, because chroot was not designed designed for security and there are many ways known to get around it.

Source Link
Sora Minazuki
Sora Minazuki
  • 231
  • 1
  • 3

You can set the chroot location differently for each user like this:

Match User a Configuration for user a Match User b Configuration for user b

OpenSSH's SFTP subsystem refuses to chroot into any directory not owned by root for security reasons, so you can't make new files right under the chroot directory unless you're root. By changing your user id to 0, you effectively became root, which is an extremely BAD idea. By becoming root, not only can your user escape the chroot jail, your user gained permission to do anything on your system, which is against the principal of least privilege.

If you were choosing to use chrooted SFTP for better security, I also doubt that it's an effective choice, because chroot was not designed designed for security and there are many ways known to get around it.