SFTP – How to Create an Isolated/Jailed SFTP User

You don't need a directory authorized_keys2, you need a directory ~/.ssh and in that directory a file authorized_keys2.

Right I managed to get some advice at #openssh IRC channel and here is what was missing from my solution:

The directory specified in ChrootDirectory must be owned by root. Since in the above sshd_config file I have specified the %u variable so every user has their own root directory base on their username (e.g. testuser would be /mnt/inbound/testuser/) then all of those directories must be owned by root. This is in fact the default when I create the directories doing sudo mkdir /mnt/inbound/<username> since the mkdir command is elevate via sudo.

So what I needed to do is to create a sub-directory under /mnt/inbound/<username> and give that directory permission for the user. In my case I called this directory uploads.

So I changed my configuration slightly as follows:

Match Group sftponly # Chroot the connection into the specified directory ChrootDirectory /mnt/inbound/%u # Force the connection to use the built-in SFTP support ForceCommand internal-sftp -d /uploads

The ForceCommand line has been changed to include -d /uploads, meaning that the default directory after the user logs-in in is /uploads. Note that it is /uploads and not /mnt/inbound/%u/uploads because it takes into account that /mnt/inbound/%u has been specified as the new root in the previous line in the config.

If I do ChrootDirectory /mnt/inbound/ an then specify ForceCommand internal-sftp -d /%u, I could make the /mnt/inbound/<username> folder be owned by the end-user since /mnt/inbound is now the new root directory that must be owned by the root account. However users would be able to navigate to the parent folder and see the directory names of all other accounts. I decided against that :)