1

I was trying to configure SFTP to a list of users, so I thought of creating a few blocks of "Match User" at "/etc/ssh/sshd_config" file.

Something like this:

# User A, B
Match User usera,userb
   ForceCommand internal-sftp
   AllowTcpForwarding no
   X11Forwarding no
   ChrootDirectory /mnt/shared/user_a_b

# User C
Match User userc
   ForceCommand internal-sftp
   AllowTcpForwarding no
   X11Forwarding no
   ChrootDirectory /mnt/shared/user_c

After that, I restarted SSH, logged out of my current user and found a first problem. Since I was using usera I locked myself out of SSH. To solve that, fortunelly, I openned root's shell and removed usera from the first stanza.

Match User userb

Now, when I try to login userb or userc to SFTP I get the error below.

$ sftp userb@localhost
userb@localhost's password:
packet_write_wait: Connection to ::1 port 22: Broken pipe
Connection closed

Basically, the only difference between users is the ChrootDirectory. How could I set up SFTP to multiple users with different folders?

Thank you

EDIT:

Looking at auth.log, the only messages shown are these:

sshd[18621]: Received signal 15; terminating.
sshd[21599]: Server listening on 0.0.0.0 port 22.
sshd[21599]: Server listening on :: port 22.
sshd[21665]: Accepted password for userb from ::1 port 50552 ssh2
sshd[21665]: pam_unix(sshd:session): session opened for user userb by (uid=0)
sshd[21700]: fatal: bad ownership or modes for chroot directory "/mnt/shared/user_a_b"
sshd[21665]: pam_unix(sshd:session): session closed for user userb

I suppose the issue is with folder permissions, right?

My shared directorys permissions are these:

drwxrwx--T 20 root sambashare 4.0K May 11 16:09 user_a_b
drwxrwx--T  2 root sambashare 4.0K May 10 23:23 user_c

What I don't get is that userb is part of shared group:

$ groups userb
userb : userb users sambashare
1

After a lot of search I believe I have found a solution. The issue was probably related to SFTP chroot jail. These might be the keywords for this problem. I changed the chroot folder permission.

$ sudo chmod 2750 /mnt/shared/user_a_b
$ sudo chmod 2750 /mnt/shared/user_c

It seems chroot directory should not have group write permission. So, basically, I removed the write permission from chroot folder. They are now like this:

$ ll /mnt/shared/
drwxr-s--- 20 root sambashare 4.0K May 19 18:36 user_a_b
drwxr-s---  2 root sambashare 4.0K May 17 23:51 user_c

Now it's working fine. Thanks to everyone.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.