2

I have a problem with chroot sftp an their home folder. I would like to write in user's home but I don't have proper permission for doing that.

sshd_config

Match User demo ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no X11Forwarding no

User

demo:x:1013:1014::/home/ftp/demo2:/bin/false

Directory

root@xxx:/# ls -l /home/ftp/ drwxr-xr-x 2 root root 4096 Nov 3 13:35 demo2

Error message

debug1: channel 0: new [client-session] debug1: Requesting [email protected] debug1: Entering interactive session. Write failed: Broken pipe

I know that I can write into a folder under /home/ftp/demo2 but I need to write in /home/ftp/demo2 not in a inner folder, it's mandatory.

I've tried to change demo2 permissions and user/group, but it was not possible to write in it.

And.. there are other problem. I have 3 users that have their homes under /home/ftp but, on the other hand, I have some users that have their home in a different path, so I can't use ChrootDirectory /home/ftp/%u, I need to use %h

Are there any way to do this?

Thanks a lot!

Improve this question
1
  • I found out that if I change user id to 0 it works and I can write into home directory but I dont like so much this way. Commented Nov 3, 2014 at 23:20

1 Answer 1

Reset to default
0

You can set the chroot location differently for each user like this:

Match User a Configuration for user a Match User b Configuration for user b

OpenSSH's SFTP subsystem refuses to chroot into any directory not owned by root for security reasons, so you can't make new files right under the chroot directory unless you're root. By changing your user id to 0, you effectively became root, which is an extremely BAD idea. By becoming root, not only can your user escape the chroot jail, your user gained permission to do anything on your system, violating the principal of least privilege. I would strongly recommend that you change your user id back to normal.

If you were choosing to use chrooted SFTP for better security, I also doubt that it's an effective choice, because chroot was not designed designed for security and there are many ways known to get around it.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.