using OpenSSH/SFTP to replace an FTP server securely

Damien Miller djm at
Tue May 20 17:30:55 EST 2014

On Mon, 19 May 2014, IMAP List Administration wrote:

> Hello Folks,
> I'm trying to replace an FTP with several hundred users with something secure.
> My requirements:
>     - transfers must be logged
>     - users should not have any access to other users' directories
>     - users should land in a writable directory
>     - users should be chrooted
> I've been trying to get this working with OpenSSH and the internal SFTP server,
> but it does not seem possible....
> If I chroot each user using "ChrootDirectory /home/%u", there are two problems:
>     1) the user lands in a directory to which he cannot write
>     2) I would need hundreds of syslog logging sockets, one in each user's
> chrooted environment

The first problem is easily solved. You can specify a different starting
directory on the sftp-server commandline using the '-d' option.


Subsystem sftp internal-sftp -d sftp

(and create 'sftp' directory under /home/$user)

The syslog problem doesn't have a good solution right now. Maybe someone
could write a patch to implement logging via the monitor, like what happens
for the pre-auth process.


More information about the openssh-unix-dev mailing list