Skip to content
TrySitePrice

Debian/Ubuntu Linux: Restrict an SSH user session to a specific directory by setting chrooted jail

Best/Tutorial

To restrict an SSH user session to a specific directory on a Debian or Ubuntu Linux system, you can set up a chrooted jail. A chrooted jail is a way to limit the file system access of an SSH user to a specific directory.

Here's how to set up a chrooted jail for an SSH user:

  1. Create a new directory for the user:
sudo mkdir /jail/username
  1. Set the ownership and permissions for the directory:
sudo chown root:root /jail/usernamernsudo chmod 755 /jail/username
  1. Copy the necessary files into the jail directory:
sudo cp -av /bin /lib /lib64 /usr /jail/username/
  1. Edit the /etc/ssh/sshd_config file and add the following line to enable chrooting for the specified user:
Match User usernamern ChrootDirectory /jail/usernamern ForceCommand internal-sftprn AllowTcpForwarding no
  1. Restart the SSH daemon to apply the changes:
sudo service ssh restart

Now, when the specified user logs in over SSH, they will be restricted to the /jail/username directory and will not be able to access the rest of the file system.

Note: This is just a basic example, and you may need to add additional files to the jail directory depending on the system and user requirements.