Chroot SFTP

Linux Rights Reminder#

# Change owner
chown -R <user>:<group> <path>

# Change rights
chmod -R 755 <path>
# 0 : --- (no rights)
# 1 : --x (execute)
# 2 : -w- (write)
# 3 : -wx (write and execute)
# 4 : r-- (read only)
# 5 : r-x (read and execute)
# 6 : rw- (read and write)
# 7 : rwx (read, write, and execute)bash

In this example, the user myuser will be chrooted in the directory myuser.

Add Group and User#

groupadd sftp_users
useradd -G sftp_users myuserbash

Add User Password (Optional)#

echo "myuser:<my_password>" | chpasswdbash

Create Directory#

mkdir -p /var/share/myuserbash

Set Permissions#

chown -R root:root /var/share
chmod -R 755 /var/share
chown myuser:sftp_users /var/share/myuserbash

Update SSH Configuration#

Edit /etc/ssh/sshd_config:

Subsystem sftp internal-sftp

Match Group sftp_users
        ChrootDirectory /var/share/%u
        ForceCommand internal-sftp
        AllowTcpForwarding no
        X11Forwarding nobash