Configuring Chroot for SFTP Users

chrootpermissionssftp

I am trying to configure a SFTP server for some automated backups. I configured an Ubuntu 14.04 server and have had partial success. The idea I'm looking to do is this:

  1. A user will be created for each particular system to be backed up. SFTP only.
  2. The user will be Chrooted and not be able to read or write outside their home directory.
  3. The user's home will be the "root" once logged in.
  4. The user will be able to upload files to the root. (This is where I'm stuck.)

I used the following snippet to create the Chroot in sshd_config like this:

Match Group sftpbackup
   ChrootDirectory /srv/sftpbackup/%u
   X11Forwarding no
   AllowTcpForwarding no
   ForceCommand internal-sftp

Then I set the permissions on /srv/sftpbackup as per the requirements.

# ls -l
total 4
drwxr-x--- 3 root sftpbackup 4096 Jan  5 15:29 user1
# 

Now, the user can login but cannot upload files (Permission Denied). If I change the directory ownership to look like this:

# ls -l
total 4
drwxrwx--- 3 user1 sftpbackup 4096 Jan  5 15:29 user1
# 

Then the user cannot login, from auth.log:

sshd[14835]: fatal: bad ownership or modes for chroot directory "/srv/sftpbackup/user1"

It seems like, if the user's home directory is the SFTP chroot, root must own the directory, thus a subdirectory must be created so that the user can write to it.

Is there anyway to make the root writeable? Looking at various websites, it appears that there is no way to achieve what I want. I don't quite understand though what the difference is between having the chroot dir writeable by the user and having a subdirectory writeable. Insights would be appreciated.

Note: My goal is to create a server where backups can be stored by various devices. The devices will be configured by a third-party vendor, thus I'm trying to keep things as simple (one user name per device, all files go to the "root" once logged in) and secure (the users created will have minimal rights to the server) as possible. Apologies if my desires are a bit rigid.

Best Answer

Internal-sftp require chrooted user home to reside inside root-owned dir:

/some/path/root-owned/user-dir1
                     /user-dir2

Root-owned dir should have 555 permissions and user-dirs should be created by root and owned by specific user. Inside subdirs user can do anything, but he can't delete or rename user-dir[12].

This is internal-sftp restrictions.

Related Topic