Technical Notes

How to Set Up chroot for SFTP Access Only in Reflection for Secure IT or F-Secure SSH UNIX Server
Technical Note 1917
Last Reviewed 01-Feb-2008
Applies To
Reflection for Secure IT UNIX Server version 6.0 or higher
F-Secure SSH Server for UNIX version 3.30 through 5.x
Summary

This technical note describes how to set up the UNIX feature, chroot, to disable a user's UNIX shell and allow SFTP access only in either the Reflection or F-Secure SSH UNIX Server.

Note: Beginning with version 6.0, the F-Secure SSH product line has a new name, "Reflection for Secure IT."

What is chroot?

Use chroot to change your system's root directory (/) for a specified process, such as the Reflection or F-Secure SSH UNIX Server. See your UNIX host documentation or man pages for more information.

Setting Up chroot in the SSH UNIX Server

To set up chroot, you must make the following modifications to the sshd2_config file. By default, this file is located in the /etc/ssh2 directory.

The steps and examples vary depending on your version.

In Reflection for Secure IT 7.x:

1. Under the Chrooted environment heading, define the users you want to chroot.

• The Subsystem-sftp default setting is correct and is required to use chroot.
• The user and group names are regular expressions, so you can use settings like:

2. Stop the sshd2 daemon:

3. Restart the ssh server process (sshd2) to force the reloading of the config files:

In Reflection for Secure IT 6.x or earlier:

1. Under the Chrooted environment heading, define the users you want to chroot. Uncomment the line ChRootUsers and add your user(s) to the list. In this example, the user is named jailuser:

2. Under /etc/passwd, change the user's shell to the dummy shell. For example:

3. Stop the sshd2 daemon:

4. Restart the ssh server process (sshd2) to force the reloading of the config files:

Related Technical Notes

1900	F-Secure SSH Technical Notes
1999	Reflection for Secure IT Technical Notes