chroot'd SFTP

Jonathan Miles jon at
Tue Jul 31 18:23:55 EST 2007

Damien Miller wrote:
> On Mon, 30 Jul 2007, Richard Storm wrote:
>>>> The big problem with that patch is that it effectively allows non-root
>>>> users to chroot to a directory of their choice.
>> How!? Doesn't sftp-server respect received "-C %d" args which are
>> hardcoded in ForceCommand, to chroot user in HIS home directory?
> by running sftp-server with a -C option of their choice

Is it really necessary to pass the chroot path to sftp-server? I wrote a 
patch a while back which jails to the target user's home directory and 
also prevents access to the shell/exec channels, amongst other things. 
So my config looks like this...

# Prevent users in restricted group from using shell and exec channels
Match Group restricted
       ChannelReqDeny shell
       ChannelReqDeny exec
       Subsystem sftp /usr/lib/openssh/sftp-server --chroot -l VERBOSE

The attached diff is against portable CVS from back in April and I've 
been using it on a dev server since then without problems. It could do 
with a little tidying up (debug stuff), a sync with latest CVS and 
perhaps making the commands a bit more user-friendly. If there's any 
interest, I'll do so...

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: chroot-portable.patch

More information about the openssh-unix-dev mailing list