Create Ftp User Restricted to Home Directory on Ubuntu

After googling for some time, this is simplest solution that I found for creating a user that is limited to the home directory and has only ftp access on Ubuntu. Do as root:

Update: the previous solution involved using vsftpd.chroot_list and a non-executable shell (such as /bin/false). This is problematic as it still allows e.g. ssh tunnels (as described here). The current solution is based on this article and this askbubuntu entry.

The first-time setup looks like this:

addgroup limitedftpusers
vim /etc/ssh/sshd_config

In sshd_config make sure that the sftp subsystem is configured like this

Subsystem sftp internal-sftp

and add this snippet to the end of the file

Match Group limitedftpusers
        ChrootDirectory %h
        AllowTCPForwarding no
        X11Forwarding no
        ForceCommand internal-sftp

and use the following to update the ssh service with the new config.

service ssh restart

(End of first-time setup)

After this initial setup, here’s how you can add a user to this now ftp-only group.

useradd -d /home/joe -M -N -g limitedftpusers joe
passwd joe
mkdir /home/joe
chown root:root /home/joe
chmod 755 /home/joe
mkdir /home/joe/upload
chown joe:limitedftpusers /home/joe/upload

The last two lines are needed to have a write-enabled directory for the user (see the askubuntu entry for more details)

This entry was posted in Software. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

Please solve this little equation for verifying that you\'re human *