1

I'm trying to make a user kake_sftp that can log in to the web server located at /var/www/html or similar. I know chroot needs some additional subdirectiories for the permissions to work out, so I'm fine with adding new folders or changing the folder layout a bit.

I created the user in group www-data and with home directory in /var/www/html

$ cat /etc/passwd | grep kake_sftp
kake_sftp:x:1001:1001::/var/www/html:/bin/bash

$ groups kake_sftp
kake_sftp : kake_sftp www-data

Then I did some changes in /etc/ssh/sshd_config. I replaced "Subsystem sftp /usr/lib/openssh/sftp-server" with "Subsystem sftp internal-sftp" and I added the following lines at the end

Match User kake_sftp
ChrootDirectory /var/www
ForceCommand internal-sftp
AllowTcpForwarding no

The permissions of the www folder is set as follows.

$ ls -la /var/www
drwxrwxr-x  3 root root     4096 Apr  7 12:17 .
drwxr-xr-x 12 root root     4096 Apr  4 10:17 ..
drwxr-xr-x  2 root www-data 4096 Apr  4 11:34 html

When I now try to log in with Filezilla set to sftp. I get the following error.

Error:  Network error: Software caused connection abort
Error:  Could not connect to server

When I try to log in with my main user via sftp, it works like a charm. So there isn't a problem with the client.

Kake_Fisk
  • 111

1 Answers1

0

The reason why this did not work was because the chrooted directory had write permissions. By revoking all write permissions, I managed to connect.

chmod 555 /var/www
Kake_Fisk
  • 111