- First add a new sftp users group, I’ve named mine ‘sftponly’.

groupadd sftponly

Open /etc/ssh/sshd_config for editing. The line you will be looking for as it appears in lenny will be :

Subsystem sftp /usr/lib/openssh/sftp-server

Change this to

Subsystem sftp internal-sftp

At the bottom of the file, you’ll need this acl

Match Group sftpusers
        ChrootDirectory /home/%u
        ForceCommand internal-sftp
        AllowTcpForwarding no
        X11Forwarding no

‘Match Group’s are terminated either by a new Match Group directive, or simply the end of file, so save and restart sshd.

/etc/init.d/sshd restart

- Make sure you can still login normally through another console

- Now adduser, assign them to the new group and strip their shell. Mine will be called feyfey

adduser feyfey
usermod -g sftponly feyfey
usermod -s /bin/false feyfey

- Next, set the user home directory ownership to root.root, and only user writable, then jump into the users directory and create a ‘public’ directory the sftp only user can write to.

chown root.root /home/feyfey
chmod 775 /home/feyfey
cd /home/feyfey
mkdir public; chown feyfey.sftpuser public

If there are any errors during your permissions testing thereafter, check /var/log/auth.log.

and you’re done