Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

3
  • The sshd of modern OpenSSH enforces the restriction that the ChrootDirectory must be writeable by root only; if this is not true, the login will fail. If a chroot directory is writeable by the chrooted user, there are some known methods to escape from a chroot; the OpenSSH requirement to have a read-only ChrootDirectory is to block these escape methods. Commented Nov 21, 2024 at 6:20
  • @telcoM The config I described has been working for me on an Ubuntu 22.04 machine for the past 2-3 years. dpkg-query -W shows the package version string as 1:8.2p1-4ubuntu0.11. Is the "modern" OpenSSH you mention newer than that? Commented Nov 21, 2024 at 6:53
  • The chrooted SFTP servers I've set up have been RHEL/CentOS for the most part, using whatever was the current supplied OpenSSH in RHEL 7, 8 and 9. I guess Ubuntu may have applied their own patch to solve the chroot escape problem in a different way. If that's not the case, they may have a security regression. Commented Nov 21, 2024 at 8:04