SELinux and chrooted sftp

Set up of sftp-only access to a server for a subset of users on a Scientific Linux 6 install with SELinux enforcing:

Create sftponly group and added users with sftp-server as their shell:

addgroup sftponly
useradd -d /home/$USERNAME -s /usr/lib/sftp-server -M -N -g sftponly $USERNAME
mkdir -p /home/$USERNAME/uploads /home/$USERNAME/.ssh
chown $USERNAME:sftponly /home/$USERNAME/uploads /home/$USERNAME/.ssh
chown root /home/$USERNAME
chmod 755 /home/$USERNAME
chmod 700 /home/$USERNAME/.ssh
passwd $USERNAME
echo '/usr/lib/sftp-server' >> /etc/shells


They will chroot into their home directory, so this needs to be owned by root and not writable by any other user, including $USERNAME. As the user won’t have write access to their own home directory, you need to manually create a .ssh directory for them and a subdirectory to which they do have write access, for their files.

Changed /etc/ssh/sshd_config to chroot to the home directory of sftp-only users

#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

Match group sftponly
ChrootDirectory %h
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp


Make sure selinux allows write access to chroot’ed home directories:


setsebool -P ssh_chroot_rw_homedirs on


I also needed to do a restorecon on the home directory to get selinux to allow sftp users to write to their uploads directory:

restorecon -R /home/$USERNAME


Seems to be working okay now.