SFTP + ChrootDirectory: Is it possible to prevent a user from exiting a folder?

Question

currently, the user connects via SFTP to the server and is placed in the files folder. Is there a way to prevent them from exiting the files folder?

sshd config for the user sftp:

Match User sftp
    ForceCommand internal-sftp -d /files/
    PasswordAuthentication no
    PubkeyAuthentication yes
    ChrootDirectory /home/sftp/uploads/
    PermitTunnel no
    AllowAgentForwarding no
    AllowTcpForwarding no
    X11Forwarding no

I know that ForceCommand internal-sftp has additional options — -P to allow, and -p to deny. However, combining them with the result I want has not worked. The closest I’ve gotten is "ForceCommand internal-sftp -d /files/ -P stat", but when I deny stat, the user can no longer download files.

Here is the full list of keys:

open, close, read, write, lstat, fstat, setstat, fsetstat, opendir, readdir, remove, mkdir, rmdir, realpath, rename, readlink, symlink, posix-rename, statvfs, fstatvfs, hardlink, fsync, lsetstat.

Has anyone faced a similar issue before? How did you solve it?

Answer 1

Here's the config I use for an SFTP server that blocks chdir outside the account's home dir:

Match group sftponly
# /opt and /opt/sftp dirs can have 755 perms,
# the /opt/sftp/authorized_keys dir should have 711,
# and the files inside it should have 600.
AuthorizedKeysFile  /opt/sftp/authorized_keys/%u
ChrootDirectory     %h
AllowTCPForwarding  no
X11Forwarding       no
ForceCommand internal-sftp

SFTP-only user accounts are created in /etc/passwd and /etc/shadow. The user's home dir is set to /opt/sftp/username, and the shell is the same as some of the system accounts: /usr/sbin/nologin. The home dir is owned by root:root. There is a subdirectory under the home dir and that subdir is owned by the user with group sftponly. (on my server, the subdir is named 'upload') The authorized keys file is like the upload directory, owned by the user, group sftponly.

To explain some of the design decisions for the above config:

• The ChrootDirectory is what prevents the sftp client from changing to a dir outside the home dir.
• ForceCommand is the simple "internal-sftp" without arguments because that works better with the ChrootDirectory parameter. There's a note in the sshd_config man page's description of ForceCommand about this.
• The authorized_keys file is set to a location outside the account's home dir to ensure the sftp client can't overwrite it or delete it.
• The account's home dir is not owned by the account to ensure the sftp client can't delete the home dir or create other files/dirs in it. The client can only create/delete files/dirs in the 'upload' subdir described above. (Or any other subdir owned by username:sftponly that you put under the home dir)
• The sftp client can create files and subdirs in the 'upload' subdir. It can even delete the 'upload' subdir, but the ownership and permissions of the home dir prevent the client from re-creating the subdir. Re-creating the subdir (or creating other subdirs in the home dir) requires intervention by a server admin.

The above configuration allows me to have ordinary ssh users (the server admins) alongside SFTP-only users, and the configurations for the different types of users don't conflict with each other.

This uses different working dirs for each SFTP user, which might not be what you're looking for. However, I think this will be helpful to you finding the config you need.