0

I have Raspberry Pi 3 and I want to be able to send and receive files through SFTP. I was able to set everything up and I can connect to my Raspberry Pi. However, I want to restrict or limit user to a specific directory not the whole system. For some reason, I am not able to do it. I searched online and found many tutorials on it, but every time I applied the tutorials I can't connect to my pi using SFTP client. If I remove all the changes I made in SSHD_CONFIG file, then it connects to my pi again. Any chances I make to SSHD_CONFIG file, SFTP client refuses to connect to my PI. Error messages I get is Connection Error. Server refused to connect.

Here is one of many tutorial I followed.

groupadd sftpgroup

usermod -G sftpgroup user1

Subsystem sftp internal-sftp

Match Group sftpgroup
   ChrootDirectory /home
   ForceCommand internal-sftp
   X11Forwarding no
   AllowTcpForwarding no

systemctl restart sshd

chmod 700 /home/user1

https://serverfault.com/questions/1022432/restricting-user-group-to-specific-folder-in-win2016-server

https://kifarunix.com/restrict-sftp-user-access-to-specific-directories-in-linux/

https://www.tecmint.com/restrict-sftp-user-home-directories-using-chroot/

What am I missing?

2 Answers 2

0

I don't know if it is mandatory, but you are missing the / after /home That is the only major difference that I find between your configuration sample and mine.

0

ChrootDirectory Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.

According to the manual, the reason why my sftp client refused to connect after I made the modifications to SSHD_CONFIG file was because the ChrootDirectory was not ROOT-OWNED. sftp will only allow connection to path to folder that are owned by root user. So, I did the following.

sudo chown root:root -R /home/user/
sudo chmod 755 -R /home/user/

Then, my sftp client connected with my SSHD_CONFIG modification. The error I got had nothing to do with the changes I added to SSHD_CONFIG file.

I am posting the answer that worked for me and it might help others.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.