Sometimes you may need to give someone access to load files onto your server. I don’t like FTP because it’s insecure and frankly I don’t want to set up a FTP server just for that. The problem with SFTP is that the user can look through your folders and has shell access. To solve this, I’ve written this tutorial on how to set up a chrooted SFTP account without shell access.

First of all, edit the file /etc/ssh/sshd_config and add/change the following:

#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

Match Group sftp
        ChrootDirectory %h
        ForceCommand internal-sftp
        AllowTcpForwarding no

The first line changes the SFTP-Subsystem to the internal SFTP-Server which is better for chrooting.

The second line (Match Group sftp) causes the lines below to only affect users in the sftp usergroup.

ChrootDirectory %h binds the users to their home directory so they can’t see what’s outside.

The next line forces internal-sftp and the last one disables TCP forwarding.

That’s it.

Now you have to create a user with the appropriate settings.

groupadd sftp
useradd -d /path/to/the/sftp/folder -s /bin/false -G sftp Username
passwd Username

There is one more thing you have to care about. The home folder of this user has to be owned by root, else you won’t be able to login. Then you can create an upload folder for the user. For example:

chown root:root /path/to/sftp/folder
mkdir /path/to/sftp/folder/uploads
chown Username:Username /path/to/sftp/folder/uploads

I found most of the information about this at this German blog: http://madapez.com/it/linux/howto-chroot-sftp-zugang-openssh-ohne-shell-ssh/