Secure Shell
OpenSSH_5.5p1, OpenSSL 0.9.8g 19 Oct 2007 -- ChrootDirectory %h not working. Jun 28 2010 12:15AM
Liam (lfitz pacbell net)
Hello, I am trying to accomplish the following:

1.) Use OpenSSH as a SFTP server.
Subsystem sftp internal-sftp

2.) Use the SFTP server for users other than my main account.
Match User '*,!lfitz'

3.) Chroot the other users into their home directory.
ChrootDirectory %h

4.) Force the command internal-sftp.
ForceCommand internal-sftp

So the config looks as follows: (hopefully this appears correctly for
readers of the message)

# Beginning of File /etc/ssh/sshd_config
# Global config values
# End of Global config values
Subsystem sftp internal-sftp
Match User '*,!lfitz'
ChrootDirectory %h
ForceCommand internal-sftp
Match User lfitz
ForceCommand /bin/bash

Basically, the SFTP server works, however it does not chroot the home
directory. Users can view parent folders (/home) and see the the other
users on the system (/home/other_user). And even view all contents of
the root directory (/). I don't know why the directive ChrootDirectory
%h is not working. I have tried chmod'ing the directories to different
values: 700, 755, 777, starting with /home and then (iirc) 750 each user
directory. This allows the client (FileZilla or AndFTP for Android) to
start in the ChrootDirectory however it does not set it to /. I'm lost,
I've tried a number of different chmod values, set Subsystem to the
direct path, set Match User to a specific user with no negation or
wildcards, and even tried ChrootDirectory /home/specified_user.

I'm on Debian 5 (lenny) with OpenSSH 5.5p1, OpenSSL 0.9.8g

Any ideas or workarounds I could use to fix this?

I have read the manpage and the followed the guide here:

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus