How To Chroot SFTP

Since version 4.8, OpenSSH supports chrooting. This guide will teach you how to lock users to a specific directory which they will not be able to leave(In My Example We Will Be Locking Users To their home directory).

Notes

I will use the user test here with the home directory /home/test. The user test belongs to the group users. I want to chroot the user to the /home directory.

Install OpenSSH

If you do not already have openssh installed please install it now. In Gentoo Issue This command to download and install the latest version of OpenSSH.

emerge -av openssh

Now we need to edit the ssh configuration file to enable SFTP.

nano /etc/ssh/sshd_config

Verify you have this line in the file:

Subsystem sftp /usr/lib/openssh/sftp-server

Then add the following stanza at the end of the file (add one for each user that you want to chroot):

Match User test
ChrootDirectory /home
AllowTCPForwarding no
X11Forwarding no
ForceCommand /usr/lib/openssh/sftp-server

Restart OpenSSH:

/etc/init.d/ssh restart

Now set each Users Home Directory private(unreadable by other users):

chmod 700 /home/test

Thats it Now Load up your favorite SFTP Client and give it a shot. It should
not be possible to leave the /home directory with the user test.

Enjoy..