SFTP Chroot Error: Broken Pipe

Update: The code below has been updated to reflect the changes identified in the marked answer, and is therefore working as expected.

I am trying to establish SFTP-only users on my server, that are jailed to their home directory. When attempting to connect to the server, I receive a broken pipe error:

debug1: Authentication succeeded (password).
Authenticated to xxxx.xxxxxxxx.com ([XX.XX.XX.XX]:22).
debug2: fd 5 setting O_NONBLOCK
debug3: fd 6 is O_NONBLOCK
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug3: send packet: type 90
debug1: Requesting
debug3: send packet: type 80
debug1: Entering interactive session.
debug1: pledge: network
debug3: send packet: type 1
packet_write_wait: Connection to XX.XX.XX.XX port 22: Broken pipe
Couldn't read packet: Connection reset by peer

I have determined that this is related to my attempts to jail the user. My sshd_config includes:

Subsystem sftp internal-sftp
Match Group sftponly ForceCommand internal-sftp -d /%u PasswordAuthentication yes ChrootDirectory /home/sftp PermitTunnel no AllowAgentForwarding no AllowTcpForwarding no X11Forwarding no

sftponly is the name of the group I created for sftp users. The owner and group of /home/sftp is root with only write-permission for the owner (0711).

$ chown root:root /home/sftp
$ chmod 0711 /home/sftp

Here is how I'm creating users (in this example, batman) -- note that I'm doing this via a Perl script, hence my use of chpasswd:

$ adduser --quiet --disabled-password --shell /bin/false --no-create-home --gecos "User" batman
$ echo "batman:batman123" | chpasswd
$ usermod -a -G sftponly batman
$ install -d -m 0755 /home/sftp/batman -o batman -g sftponly

Note: I'm manually creating the users home directory rather than passing the --system arg for adduser, as I end up getting an error when I later try and change the directory ownership:

chown: invalid group: ‘batman:batman’

If I update my sshd_config, and change the chroot directory to:

ChrootDirectory /home/sftp

I can successfully access the server and no longer receive the broken pipe error. However, I land in /home/sftp upon login, where I see a list of all other user directories, rather than landing in /home/sftp/batman as I would expect to happen.

How can I improve/fix this, such that users:

• only have access to their own directory (/home/sftp/batman)
• upon login, will appear to be within / (which is actually /home/sftp/batman)
• cannot navigate to /home/sftp (so that they cannot see a list of other users)

1 Answer

I have managed to accomplish this by applying these permissions:

$ chown batman:sftponly /home/sftp/batman
$ chmod 0755 /home/sftp/batman
$ chmod 0711 /home/sftp

Then changing the ChrootDirectory from /home/sftp/%u to /home/sftp,

And lastly moving the user into their home directory upon login:

ForceCommand internal-sftp -d /%u

Now, when batman logs in, they land in /home/sftp/batman, which appears as /batman to the user. More importantly, if they attempt to back out into /home/sftp, they receive an error (thereby preventing them from see other user directories):

Directory /: permission denied - Failed to retrieve directory listing