SOLVED Chroot for SFTP doesn't work? (upd: works, manual included)

[Aku]

TrueNAS SCALE 22.12.2. Users, despite chroot being enabled, can rise above their home directory. Yes, they only view the list of files, but this is also unacceptable. I have seen several threads on the forum regarding this, but nowhere is there a solution to this problem.

 

[Aku]

Chroot working now! I leave instructions for those who are puzzled by the same question. For chroot to work, you need the following:

• All folders included in the path to the user’s home folder must be owned by root with rights 755

• Inside the home folder you need to create a folder in which the user can write (it doesn’t matter whether he will be the owner or the rights will come from the group)

• In the SSH service settings, in the "Auxiliary Parameters" field, add the following lines:

Match Group sftp​

ChrootDirectory %h​

ForceCommand internal-sftp​

AllowTcpForwarding no​

X11Forwarding no​

​

​

When the service is restarted, TrueNAS writes these lines to /etc/ssh/sshd_config, which is what we need.​

The first line says that subsequent settings will be applied to a specific group (in my example to "sftp", but you can create any group).​

The second line says that the user's home folder will be used as the chroot directory.​

The third line says that the user will only work in sftp mode.​

The fourth and fifth lines are optional. They disable port forwarding and X's respectively.​

• Add the required users to the "sftp" group

• Restart the SSH service

This is all.


As an example:

• The user "user1" is a member of the group "sftp". Home directory "/mnt/pool1/user1". "/mnt", "/mnt/pool1/" and "/mnt/pool1/user1" have rights 755, the owner is "root" and the group is "root". The folder for writing files is "/mnt/pool1/user1/files" with rights 750, owner "user1", group "root".

• The user "user2" is a member of the group "sftp". Home directory "/mnt/pool1/user2". "/mnt", "/mnt/pool1/" and "/mnt/pool1/user2" have rights 755, the owner is "root" and the group is "root". The folder for writing files is "/mnt/pool1/user2/files" with rights 750, owner "user2", group "root".

• For convenience, when connecting, you can immediately set the initial folder to “/files” in your sftp client.