Mdthbs

How can I shift my job responsibilities back to programming?

How to remove ambiguity: "... lives in the city of H, the capital of the province of NS, WHERE the unemployment rate is ..."?

How can I categorize files in a directory based on their content?

Can I not use QM-AM inequality to solve this?

Is it okay for a ticket seller in the USA to refuse to give you your change, keep it for themselves and claim it's a tip?

On math looking obvious in retrospect

As a 16 year old, how can I keep my money safe from my mother?

Why is the result of ('b'+'a'+ + 'a' + 'a').toLowerCase() 'banana'?

"Install Spotify" can't be opened because Apple cannot check it for malicious software

What should I call bands of armed men in Medieval Times?

Is the equation dG = Vdp - SdT valid only for a reversible process? Can it be applied for an irreversible one too?

Two matrices that are not similar have (almost) same eigenvalues

TreeView class in WPF class

Annotating a table with arrows

What is the difference between 型 and 形?

Can sampling rate be a floating point number?

In SQL Server, why can a backward scan of clustered index cannot not use parallelism?

How do some PhD students get 10+ papers? Is that what I need for landing good faculty position?

Why are Tucker and Malcolm not dead?

Can you castle with a "ghost" rook?

Can a fight scene, component-wise, be too complex and complicated?

The cat ate your input again!

Why does not work chown in RUN command in Docker?

What gave Harry Potter the idea of writing in Tom Riddle's diary?

How to restrict ssh users to browse only /home/%u contents

Restrict a user to home directory without modifying /home/%u permissionsSet up chroot for LDAP users in RHEL6How to create a SOCKS only group?How to set up chrooted and non-chrooted sftp?Can't SSH into localhostCan't chroot new usersssh fails with “could not find home directory” (which exists and has permissions) even while a local terminal logs the same user inSSH Configuration Help / Can't tunnelConfiguring users to SSH loginAllow user to connect using SSH or SFTP but limit to home dir (Centos7)Debian SFTP WinSCP “Authentication failed.” User in Group can't establish SFTP connection

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}

6

3

Can I confine my users to their /home/%u directory using only OpenSSH configuration? From instructions I found on the Internet, I stopped the SSH server and appended the following to the sshd_config file:

Match group sftpusers

    ChrootDirectory /home/%u

    X11Forwarding no

    AllowTcpForwarding no

I then started the SSH server again.

FYI I have the users added to sftpusers group

My users can still browse i.e cd / and are able to use cat command to list file content (cat /usr/bin/test.sh) in entire file structure on my system

I'm running Ubuntu Server 12.04 LTS.

ssh chroot

share|improve this question

edited Oct 31 '12 at 11:05

derobert

78.7k88 gold badges173173 silver badges230230 bronze badges

asked Oct 31 '12 at 10:53

MaheshwarMaheshwar

3111 gold badge11 silver badge22 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  server logs and/or client verbose connection might give more info?
  
  – Karthik T
  Oct 31 '12 at 11:06
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What are the perms on your home dir? For chroot to work with SSH the home dir must be root owned and 755 perm. Check auth.log for some clues.
  
  – didster
  Oct 31 '12 at 11:24
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Client Logs ------------------------------- ssh user4@192.168.1.2 user4@192.168.1.2's password: Last login: Wed Oct 31 21:37:39 2012 from mylap.local user4@mahesh:~$ cd / user4@mahesh:/$ ls /home/user2/ 1.log examples.desktop user4@mahesh:/$ ___________________________________ Server configuration is same as mentioned above .(i don't how to attach a file in this site,pls suggest if you know) /home/ directory permissions have 755
  
  – Maheshwar
  Oct 31 '12 at 18:20
  
  
  

  
  
  
  

add a comment | 

6

3

Can I confine my users to their /home/%u directory using only OpenSSH configuration? From instructions I found on the Internet, I stopped the SSH server and appended the following to the sshd_config file:

Match group sftpusers

    ChrootDirectory /home/%u

    X11Forwarding no

    AllowTcpForwarding no

I then started the SSH server again.

FYI I have the users added to sftpusers group

My users can still browse i.e cd / and are able to use cat command to list file content (cat /usr/bin/test.sh) in entire file structure on my system

I'm running Ubuntu Server 12.04 LTS.

ssh chroot

share|improve this question

edited Oct 31 '12 at 11:05

derobert

78.7k88 gold badges173173 silver badges230230 bronze badges

asked Oct 31 '12 at 10:53

MaheshwarMaheshwar

3111 gold badge11 silver badge22 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  server logs and/or client verbose connection might give more info?
  
  – Karthik T
  Oct 31 '12 at 11:06
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What are the perms on your home dir? For chroot to work with SSH the home dir must be root owned and 755 perm. Check auth.log for some clues.
  
  – didster
  Oct 31 '12 at 11:24
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Client Logs ------------------------------- ssh user4@192.168.1.2 user4@192.168.1.2's password: Last login: Wed Oct 31 21:37:39 2012 from mylap.local user4@mahesh:~$ cd / user4@mahesh:/$ ls /home/user2/ 1.log examples.desktop user4@mahesh:/$ ___________________________________ Server configuration is same as mentioned above .(i don't how to attach a file in this site,pls suggest if you know) /home/ directory permissions have 755
  
  – Maheshwar
  Oct 31 '12 at 18:20
  
  
  

  
  
  
  

add a comment | 

Can I confine my users to their /home/%u directory using only OpenSSH configuration? From instructions I found on the Internet, I stopped the SSH server and appended the following to the sshd_config file:

Match group sftpusers

    ChrootDirectory /home/%u

    X11Forwarding no

    AllowTcpForwarding no

I then started the SSH server again.

FYI I have the users added to sftpusers group

My users can still browse i.e cd / and are able to use cat command to list file content (cat /usr/bin/test.sh) in entire file structure on my system

I'm running Ubuntu Server 12.04 LTS.

ssh chroot

share|improve this question

edited Oct 31 '12 at 11:05

derobert

78.7k88 gold badges173173 silver badges230230 bronze badges

asked Oct 31 '12 at 10:53

MaheshwarMaheshwar

3111 gold badge11 silver badge22 bronze badges

Match group sftpusers

    ChrootDirectory /home/%u

    X11Forwarding no

    AllowTcpForwarding no

share|improve this question

edited Oct 31 '12 at 11:05

derobert

78.7k88 gold badges173173 silver badges230230 bronze badges

asked Oct 31 '12 at 10:53

MaheshwarMaheshwar

3111 gold badge11 silver badge22 bronze badges

share|improve this question

edited Oct 31 '12 at 11:05

derobert

78.7k88 gold badges173173 silver badges230230 bronze badges

asked Oct 31 '12 at 10:53

MaheshwarMaheshwar

3111 gold badge11 silver badge22 bronze badges

edited Oct 31 '12 at 11:05

derobert

78.7k88 gold badges173173 silver badges230230 bronze badges

edited Oct 31 '12 at 11:05

derobert

78.7k88 gold badges173173 silver badges230230 bronze badges

asked Oct 31 '12 at 10:53

MaheshwarMaheshwar

3111 gold badge11 silver badge22 bronze badges

asked Oct 31 '12 at 10:53

MaheshwarMaheshwar

3111 gold badge11 silver badge22 bronze badges

3 Answers
3

active

oldest

votes

5

First of all, I would suggest using ChrootDirectory %h instead of /home/%u, as %h expands to the user's home, even if it's no /home/$USER.

Now to your actual problem: you need to force internal-sftp as the command to be run. The following config works just fine for me, and should also for you:

Match group sftp

    ForceCommand internal-sftp

    ChrootDirectory %h

    X11Forwarding no

    AllowTcpForwarding no

The user's home should be root-owned and have 755 permisions as mentioned above:

drwxr-xr-x 22 root root 4.0K Nov 24  2011 /home/testuser

share|improve this answer

answered Nov 1 '12 at 17:57

zhenechzhenech

99366 silver badges88 bronze badges

add a comment | 

0

Using fakechroot

1. Prepare the user and the directory you want to use for the SSH. For example, you might want to copy some commands from /bin directory into the user's bin directory. It is considered that the user's name is test and user's directory is /home/test.



2. 
   

   Install fakechroot package.

   
   
   

   # Debian-based distros
   
   sudo apt install fakechroot
   
   

   
   



3. Open OpenSSH server configuration file for editing (e.g. /etc/ssh/sshd_config).



4. 
   

   Add the following lines to the configuration file (, or replace existing lines if exist):

   
   
   

   # Replace test with your user of choice
   
   Match User test
   
       ForceCommand fakechroot chroot /home/test
   
       # Other options
   
   

   
   



5. Save the file. Start OpenSSH server on the specific port you want. Now, try logging in via SSH. Everything should work as expected.

Hope it helps!

share|improve this answer

answered 2 hours ago

MAChitgarhaMAChitgarha

12144 bronze badges

add a comment | 

-1

I know this question is old but this helped me.

chmod o-x /home/*

run the above command from sudo and it will limit a user to its own home dir.

share|improve this answer

answered May 5 '15 at 10:54

scottydeltascottydelta

9911 bronze badge

• 
  
  
  

  
  4
  

  
  
  
  
  
  

  
  
  It looks to me this forbid other to browse your directory, but doesn't confine you to your home dir.
  
  – Archemar
  May 5 '15 at 11:05
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, that's what it does.
  
  – scottydelta
  May 5 '15 at 19:40
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f53409%2fhow-to-restrict-ssh-users-to-browse-only-home-u-contents%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

5

First of all, I would suggest using ChrootDirectory %h instead of /home/%u, as %h expands to the user's home, even if it's no /home/$USER.

Now to your actual problem: you need to force internal-sftp as the command to be run. The following config works just fine for me, and should also for you:

Match group sftp

    ForceCommand internal-sftp

    ChrootDirectory %h

    X11Forwarding no

    AllowTcpForwarding no

The user's home should be root-owned and have 755 permisions as mentioned above:

drwxr-xr-x 22 root root 4.0K Nov 24  2011 /home/testuser

share|improve this answer

answered Nov 1 '12 at 17:57

zhenechzhenech

99366 silver badges88 bronze badges

add a comment | 

5

First of all, I would suggest using ChrootDirectory %h instead of /home/%u, as %h expands to the user's home, even if it's no /home/$USER.

Now to your actual problem: you need to force internal-sftp as the command to be run. The following config works just fine for me, and should also for you:

Match group sftp

    ForceCommand internal-sftp

    ChrootDirectory %h

    X11Forwarding no

    AllowTcpForwarding no

The user's home should be root-owned and have 755 permisions as mentioned above:

drwxr-xr-x 22 root root 4.0K Nov 24  2011 /home/testuser

share|improve this answer

answered Nov 1 '12 at 17:57

zhenechzhenech

99366 silver badges88 bronze badges

add a comment | 

First of all, I would suggest using ChrootDirectory %h instead of /home/%u, as %h expands to the user's home, even if it's no /home/$USER.

Now to your actual problem: you need to force internal-sftp as the command to be run. The following config works just fine for me, and should also for you:

Match group sftp

    ForceCommand internal-sftp

    ChrootDirectory %h

    X11Forwarding no

    AllowTcpForwarding no

The user's home should be root-owned and have 755 permisions as mentioned above:

drwxr-xr-x 22 root root 4.0K Nov 24  2011 /home/testuser

share|improve this answer

answered Nov 1 '12 at 17:57

zhenechzhenech

99366 silver badges88 bronze badges

Match group sftp

    ForceCommand internal-sftp

    ChrootDirectory %h

    X11Forwarding no

    AllowTcpForwarding no

drwxr-xr-x 22 root root 4.0K Nov 24  2011 /home/testuser

share|improve this answer

answered Nov 1 '12 at 17:57

zhenechzhenech

99366 silver badges88 bronze badges

answered Nov 1 '12 at 17:57

zhenechzhenech

99366 silver badges88 bronze badges

answered Nov 1 '12 at 17:57

zhenechzhenech

99366 silver badges88 bronze badges

0

Using fakechroot

1. Prepare the user and the directory you want to use for the SSH. For example, you might want to copy some commands from /bin directory into the user's bin directory. It is considered that the user's name is test and user's directory is /home/test.



2. 
   

   Install fakechroot package.

   
   
   

   # Debian-based distros
   
   sudo apt install fakechroot
   
   

   
   



3. Open OpenSSH server configuration file for editing (e.g. /etc/ssh/sshd_config).



4. 
   

   Add the following lines to the configuration file (, or replace existing lines if exist):

   
   
   

   # Replace test with your user of choice
   
   Match User test
   
       ForceCommand fakechroot chroot /home/test
   
       # Other options
   
   

   
   



5. Save the file. Start OpenSSH server on the specific port you want. Now, try logging in via SSH. Everything should work as expected.

Hope it helps!

share|improve this answer

answered 2 hours ago

MAChitgarhaMAChitgarha

12144 bronze badges

add a comment | 

0

Using fakechroot

1. Prepare the user and the directory you want to use for the SSH. For example, you might want to copy some commands from /bin directory into the user's bin directory. It is considered that the user's name is test and user's directory is /home/test.



2. 
   

   Install fakechroot package.

   
   
   

   # Debian-based distros
   
   sudo apt install fakechroot
   
   

   
   



3. Open OpenSSH server configuration file for editing (e.g. /etc/ssh/sshd_config).



4. 
   

   Add the following lines to the configuration file (, or replace existing lines if exist):

   
   
   

   # Replace test with your user of choice
   
   Match User test
   
       ForceCommand fakechroot chroot /home/test
   
       # Other options
   
   

   
   



5. Save the file. Start OpenSSH server on the specific port you want. Now, try logging in via SSH. Everything should work as expected.

Hope it helps!

share|improve this answer

answered 2 hours ago

MAChitgarhaMAChitgarha

12144 bronze badges

add a comment | 

Using fakechroot

1. Prepare the user and the directory you want to use for the SSH. For example, you might want to copy some commands from /bin directory into the user's bin directory. It is considered that the user's name is test and user's directory is /home/test.



2. 
   

   Install fakechroot package.

   
   
   

   # Debian-based distros
   
   sudo apt install fakechroot
   
   

   
   



3. Open OpenSSH server configuration file for editing (e.g. /etc/ssh/sshd_config).



4. 
   

   Add the following lines to the configuration file (, or replace existing lines if exist):

   
   
   

   # Replace test with your user of choice
   
   Match User test
   
       ForceCommand fakechroot chroot /home/test
   
       # Other options
   
   

   
   



5. Save the file. Start OpenSSH server on the specific port you want. Now, try logging in via SSH. Everything should work as expected.

Hope it helps!

share|improve this answer

answered 2 hours ago

MAChitgarhaMAChitgarha

12144 bronze badges

share|improve this answer

answered 2 hours ago

MAChitgarhaMAChitgarha

12144 bronze badges

answered 2 hours ago

MAChitgarhaMAChitgarha

12144 bronze badges

answered 2 hours ago

MAChitgarhaMAChitgarha

12144 bronze badges

-1

I know this question is old but this helped me.

chmod o-x /home/*

run the above command from sudo and it will limit a user to its own home dir.

share|improve this answer

answered May 5 '15 at 10:54

scottydeltascottydelta

9911 bronze badge

• 
  
  
  

  
  4
  

  
  
  
  
  
  

  
  
  It looks to me this forbid other to browse your directory, but doesn't confine you to your home dir.
  
  – Archemar
  May 5 '15 at 11:05
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, that's what it does.
  
  – scottydelta
  May 5 '15 at 19:40
  

  
  
  
  

add a comment | 

-1

I know this question is old but this helped me.

chmod o-x /home/*

run the above command from sudo and it will limit a user to its own home dir.

share|improve this answer

answered May 5 '15 at 10:54

scottydeltascottydelta

9911 bronze badge

• 
  
  
  

  
  4
  

  
  
  
  
  
  

  
  
  It looks to me this forbid other to browse your directory, but doesn't confine you to your home dir.
  
  – Archemar
  May 5 '15 at 11:05
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, that's what it does.
  
  – scottydelta
  May 5 '15 at 19:40
  

  
  
  
  

add a comment | 

I know this question is old but this helped me.

chmod o-x /home/*

run the above command from sudo and it will limit a user to its own home dir.

share|improve this answer

answered May 5 '15 at 10:54

scottydeltascottydelta

9911 bronze badge

chmod o-x /home/*

share|improve this answer

answered May 5 '15 at 10:54

scottydeltascottydelta

9911 bronze badge

answered May 5 '15 at 10:54

scottydeltascottydelta

9911 bronze badge

answered May 5 '15 at 10:54

scottydeltascottydelta

9911 bronze badge