Editing Sftp chroot configuration

* Read https://askubuntu.com/a/206376 

 /etc/ssh/[[sshd_config]]


1) First step

 #Subsystem sftp /usr/lib/openssh/sftp-server
 Subsystem sftp internal-sftp


2) Second step
and create a user section at the end of the file (ssh can die respawning if placed after Subsystem line):

 [[Match]] User john
    [[ChrootDirectory]] [[%h]]
    ForceCommand internal-sftp
    AllowTCPForwarding no
    X11Forwarding no

Others: 
* %u (User)
* %h (home directory)


Multiple users:
  [[Match]] User USER1,USER2



With double [[Match]] rule
 [[Match]] User john [[LocalPort]] 2222 
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTCPForwarding no
    X11Forwarding no

3) Review privileges from <code>[[ChrootDirectory]]</code>  directory



== Logs ==

[[scp]] error
  protocol error: mtime.sec not present

<code>[[sshd -T]]</code>
 'Match LocalPort' in configuration but 'lport' not in connection test specification.


== Related commands ==
* <code>[[useradd]]</code>

== See also ==
* {{sftp}}
* {{rsync}}
* {{sshd}}


[[Category:Computing]]
@@ Line 1: / Line 1: @@
-[[OpenSSH 4.9]]+ (2008) includes a built-in chroot for SFTP.
+* Read https://askubuntu.com/a/206376
+ /etc/ssh/[[sshd_config]]
-== Configuration ==
-* Read ask Ubuntu, How can I chroot sftp-only SSH users into their homes? https://askubuntu.com/a/206376
+) First step
-=== 1) Modify <code>[[Subsystem]]</code> to <code>[[internal-sftp]]</code> ===
- Modify <code>/etc/ssh/[[sshd_config]]</code> file
   #Subsystem sftp /usr/lib/openssh/sftp-server
-  Subsystem sftp [[internal-sftp]]
+  Subsystem sftp internal-sftp
-=== 2) Create a user section at the end of the file (ssh can die respawning if placed after Subsystem line) ===
+) Second step
+and create a user section at the end of the file (ssh can die respawning if placed after Subsystem line):
   [[Match]] User john
      [[ChrootDirectory]] [[%h]]
-     ForceCommand [[internal-sftp]]
+     ForceCommand internal-sftp
-     [[AllowTCPForwarding]] no
+     AllowTCPForwarding no
      X11Forwarding no
@@ Line 40: / Line 36: @@
      X11Forwarding no
-=== 3) Review privileges from <code>[[ChrootDirectory]]</code>  directory ===
+) Review privileges from <code>[[ChrootDirectory]]</code>  directory
-=== 4) [[Create a new user account]] ===
- [[useradd --create-home]] USERNAME
- [[su]] - USERNAME
- [[mkdir -p]] ~/[[.ssh]]
- [[chmod]] og-rxw [[~]]/.ssh
- [[touch]] ~/.ssh/[[authorized_keys]] && [[chmod]] og-rw ~/.ssh/authorized_keys
- [[passwd]] USERNAME
- [[mkdir -p]] /path/to/directory/upload
- chmod 777 /path/to/directory/upload
- Add user on [[Match]] section on [[/etc/ssh/sshd_config]] file
+== Logs ==
- [[sshd -t]]
- [[systemctl restart sshd]] && [[systemctl status sshd]]
-== Logs ==
 [[scp]] error
    protocol error: mtime.sec not present
@@ Line 65: / Line 48: @@
   'Match LocalPort' in configuration but 'lport' not in connection test specification.
-See also: <code>[[LogLevel]]</code>
-== Related terms ==
+== Related commands ==
-* <code>[[useradd]] -m USERNAME</code>
+* <code>[[useradd]]</code>
-* https://wiki.archlinux.org/index.php/SFTP_chroot
 == See also ==