Cfrgtkky

I would like to create sftp user account on Ubuntu server which has read/write access only to one specific folder. I would like this user to have rights to transfer files up and from my server via sftp. My server is hosted on Digital Ocean.

I have followed this tutorial on Digital Ocean which seems to do exactly what I want but I got stuck at Step 4.

Step 4 says that you try this command:

ssh sammyfiles@localhost

And result should be:

Error message

This service allows sftp connections only.

Connection to localhost closed.

Instead my result is:

packet_write_wait: Connection to 207.154.238.143 port 22: Broken pipe

Connection closed

Next it instructs running this, which should obviously work:

sftp sammyfiles@localhost

The result should be:

SFTP prompt

Connected to localhost.

sftp>

but instead I get:

forge@BitCloud:~$ sftp misjah@localhost

misjah@localhost's password: 

packet_write_wait: Connection to 127.0.0.1 port 22: Broken pipe

Couldn't read packet: Connection reset by peer

I get the same message if I want to sftp with this newly created user from outside:

prmbair:~ primozrome$ sftp misjah@207.xxx.xxx.xxx

misjah@207.xxx.xxx.xxx's password: 

packet_write_wait: Connection to 207.154.238.143 port 22: Broken pipe

Connection closed

prmbair:~ primozrome$ 

What am I doing wrong?

Update from comments:
Seems like problem is in the sshd_config - ChrootDirectory line. If I use ChrootDirectory %h then sftp to users home directory works, but if I use ChrootDirectory /home/user/uploads (to restrict only to one folder) then:

packet_write_wait: Connection to 127.0.0.1 port 22: Broken pipe. 

Couldn't read packet: Connection reset by peer. 

Any idea?

I think there is a mistaken about the rights...

Could you show us the return of the command ls -l in your directory /var/sftp please ?

I think /var/sftp have 755 rights but not /var/sftp/uploads because the chmod command isn't recursive if we don't tell it, so you would have to type :
sudo chmod 755 -R /var/sftp (the -R parameter for recursive).
With -R, all subdirectories in /var/sftp will have 755 rights.

Could you try it please ?

Good luck !

From https://man.openbsd.org/sshd_config

ChrootDirectory
Specifies the pathname of a directory to chroot(2) to after authentication. At session startup sshd(8) checks that all components of the pathname are root-owned directories which are not writable by any other user or group.

I had the same problem and the solution was to avoid using a directory in a user's home, as the /home/user directory should not be owned by root, but to create instead a directory in e.g. /var/sftp/uploads, where /var/sftp/ is root owned and /var/sftp/uploads is owned by the sftp user.
Then I can chroot the sftp user in uploads.

ChrootDirectory /var/sftp

in /etc/ssh/sshd_config