Created attachment 2107 [details] Diffs agains NetBSD 5.1 I find that the internal-sftp mostly does what I want except that it leaves the user in the root of the chroot area. I can't make the user's directory the chroot since that is not owned by root. So I added code to allow me to specify the home directory. So, for example, I have the following Match stanza in sshd_config: Match Group sftponly ChrootDirectory /u/ AllowTCPForwarding no X11Forwarding no ForceCommand internal-sftp HomeDirectory /%u/ Now the user is dropped into his own home directory under the chroot area. I'm not sure if the name is correct - we don't have to actually specify his home directory - but I have tested this on NetBSD 5.1 and it works.
Actually, when ChrootDirectory is in use sshd will try to change to the user's home directory as obtained from the password database.
That's not what I saw in my case. If you mean the system passwd file then that does not help. That might be a different structure than the chrooted area. I tried creating a passwd file in the chroot are but that didn't work. Maybe it is internal-sftp that is different. Try it yourself. Create a test user and group and add a Match stanza similar to the one in my report except for the HomeDirectory. See if you can make a passwd file that will drop that user into their home directory. I tried all sorts of things and none of them worked.
No, it uses the system password file and not one inside the chroot. You can recreate the home directory structure from the password file inside the chroot and it will work. E.g. create /u/home/sftponly (if that's what the password home directory is)
Again, not that useful. Here is the issue. My user is "joe" so his home directory, where his public_html lives, is /u/joe. In the chroot directory he is /joe. I want him to wind up in /joe. After chroot /u/joe doesn't even exist. But I need it to exist in the top level in order to display his web site so I can't modify /etc/passwd. Yes, I could probably do all sorts of funky links/null mounts but a simple sshd_config directive would be so much simpler and cleaner. I do create a passwd and group file under /u so that directory listings show ownership.