This always ends up being a bit tricky, and some guides I’ve found on the net differ slightly from what I’ve got here. This seems to work pretty well for me on Debian.
Enter the following into /etc/sshd/config to allow sftp and to lock a user into a specific chroot’ed directory:
Subsystem sftp /usr/lib/openssh/sftp-server
For each user you want to lock down, you’ll first need to add the user, set the shell to false so they can’t log in via ssh and then set their home directory to where you want them chroot’ed:
useradd jorbloggs usermod -s /bin/false joebloggs usermod -d /srv/www/somehome/ joebloggs
Now just add a few details for the user to /etc/sshd/config:
Match User joebloggs X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp ChrootDirectory %h
Important!
The users home directory must be owned by root and only writable by root – bit weird, but you get odd auth messages and it doesn’t work otherwise. There’s probably a work-around for this, but for me it doesn’t really matter. If or when I do need a work around I’ll post it here. Feel free to leave comments with tips/suggestions!
Hello, thanks for the tutorial, however when I change this setting, the user can no longer connect via ssh. I get a “Network Error: Software caused connection abort” message.