H's Blog A good shell is the best user interface.

SFTP using ChrootDirectory

In newer releases of OpenSSH it's almost as easy as with ProFTPD's DefaultRoot to restrict a user to the home folder. You no longer need to setup a chroot-Environment including copies/links to essential libraries etc.

In Debian/Ubuntu just apply a few changes to /etc/ssh/sshd_config:

• Create a group (e.g. by addgroup restricted), that will contain the users subject to the restriction to their home folders.
• Change the following line for the sftp protocol:
  Subsystem sftp internal-sftp
• Add a section that matches the group and adds restriction to sftp in the home folder:
  Match group restricted
ChrootDirectory %h
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

The permissions on the home folder path are critical, don't grant to much permissions to other (non-root) users and watch out for corresponding messages in /var/log/auth.log, if sftp does not work.