SFTP chroot jail help

Once you mention chroot in its config a user cannot login anymore. ssh or sftp. Log entry is:

I checked it and permissions are correct: root owned, not writable by any other user down to the user's homedir which is custom not under /Users.

I hate it when Apple messes around with a perfectly good UNIX system. Stupid.

First off, why do you think the built-in version is going to work any differently as far as 'multiuser' is concerned.

The ability to server user content from the home directories is just a facet of the userdir module, which is part of the standard Apache distribution - in other words, it should just be a simple switch in httpd.conf to turn it on in your existing version.

That's not to say there are no reasons to use the built-in, just that it shouldn't be a pre-requisite for your other request. Indeed, there are valid reasons to stick with your own version - you're not tied to Apple's software update cycle, for example, to deploy newer versions of Apache or PHP.

In either case, your SFTP issue is simply a matter of editing /etc/sshd_config. If you want these users to only use SFTP then it's pretty trivial - much easier than allowing them full SSH access restricted to their home directory.

To restrict a set of users to chrooted SFTP-only just add the following to /etc/sshd_config

Match Group sftpusers

ChrootDirectory %h

ForceCommand internal-sftp

AllowTcpForwarding no

Then add a group called 'sftpusers' to your directory and add the relevant users to that group (of, alternatively, specify an existing group name if you have one)

Note that this will prevent those users from logging in with a regular SSH connection, since they're forced to use SFTP.

The 'ChrootDirectory %h' statement locks them to their home directory, and TCP Forwarding is disabled (to prevent the users from opening tunneled ports once connected.

Is it possible to set a different directory than %h with ChrootDirectory? When I try, all I get for any attempt to connect is:

ssh_exchange_identification: Connection closed by remote host

I don't want users to FTP to their home directory; I want to chroot their files into a central FTP directory I've created. But I can't get ftpd to allow that. Any thoughts?

Hello Kurt

I am looking for the same solution. I want to set a own folder as ftp target for the client. Is nearly impossible. Everytime i land on the root directory of the server when using the ftp protocol

Gérard

I found a workable solution here: http://serverfault.com/questions/354295/how-do-i-change-a-users-base-dir-in-os-x

Only caveat is that I had to use sudo from an admin account to make it work. But once set, it worked pretty well for SFTP access via Fetch and Dreamweaver.