Here’s the steps to create chrooted SFTP users.
1. Comment out the following line in /etc/ssh/sshd_config
|
1 |
Subsystem sftp /usr/libexec/openssh/sftp-server |
2. Append the following in /etc/ssh/sshd_config
|
1 2 3 4 5 6 |
Subsystem sftp internal-sftp # SFTP users Match User USERNAME ChrootDirectory /var/www/vhosts/MYDOMAIN.COM ForceCommand internal-sftp |
where USERNAME is the user and ChrootDirectory is the path that the user will be locked into. Add a new “Match User” stanza for each user that needs to be chrooted. This allows each user to have a unique directory.
3. Restart SSH
|
1 |
service sshd restart |
4. Create the SFTP user group
|
1 |
groupadd sftponly |
5. Modify the user
|
1 2 3 |
usermod -g sftponly USERNAME usermod -s /bin/false USERNAME |
SCP and SSH are not allowed with this setup but you could change the shell to allow them…
|
1 |
usermod -s /bin/bash USERNAME |
6. The highest directory in the chroot tree must be owned by user/group root
|
1 2 |
chown root:root /var/www/vhosts/MYDOMAIN.COM chmod 755 /var/www/vhosts/MYDOMAIN.COM |
