Setting up an ftp user to upload website files

Question

I have created a user, edited the /etc/ssh/sshd_config file with the user ChrootDirectory. Ssh restarts no problem. Filezilla connects but then the system immediately disconnects. I want this user to access multiple websites so I made a folder in /var/www and set the user as the owner of that folder - which seems like a bad idea (following and AI suggestion). But it won’t stay connected. What am I missing?

Bobby · Answer

Hi there, It might be that the ChrootDirectory setting is causing the disconnect. When a user is chrooted, the directory must be owned by root and not writable by anyone else, otherwise, the SFTP session will fail. Since you want this user to access multiple folders, that setup could be too restrictive. You could try removing the chroot part and just rely on regular SFTP access through SSH instead. As long as permissions under /var/www are set correctly, that should work, but it depends a bit on your exact setup.

alexdo · Answer

Hi there, Bobby’s diagnosis is right that ChrootDirectory ownership is the cause, and the AI suggestion you mentioned following is exactly what broke it, worth being precise about why so the fix actually sticks. OpenSSH’s rule isn’t just about the chroot directory itself, it applies to the entire path from that directory up to the filesystem root: every directory in that chain must be owned by root and not writable by group or other. Making the user the owner of the /var/www folder you chrooted into violates that directly, which is why the session drops immediately after authenticating instead of giving you a permissions error you could act on. The fix isn’t to drop chroot, since that would let this user roam your whole filesystem, which you presumably don’t want for an FTP style upload account. Instead, keep the chroot directory root owned and locked down, then give the user a writable directory nested inside it: mkdir -p /var/www/chroot/USERNAME/website chown root:root /var/www/chroot/USERNAME chmod 755 /var/www/chroot/USERNAME chown USERNAME:USERNAME /var/www/chroot/USERNAME/website Then point ChrootDirectory at /var/www/chroot/USERNAME in sshd_config, and have the user upload into the website subfolder, not the chroot root itself. That subfolder can be a symlink or bind mount back to your actual site directory under /var/www if you don’t want to physically relocate content, since the ownership requirement only applies to the chroot root, not what’s mounted inside it. Regards

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

Setting up an ftp user to upload website files

Related questions

Request to Unblock Outbound SMTP Ports 587 and 465

What Is the No.1 Technology Today That Developers Must Master to Build Next-Gen Social Media Apps?

I would like to get information about my account.

How can AI and machine learning personalize content feeds in new social media apps?

How to create a social media app that respects user privacy and builds trust?

AstroJS project hosted on DigitalOcean droplet with Nginx – CSS loading as text/html

What’s the Biggest Technical Challenge You Faced in Messaging App Development — and How Did You Solve It?

Issue with store/landing page not loading properly after migration from Hostinger to DigitalOcean

A tip to optimize the order in the .htaccess file

Deploying a Web App with a Scottish Touch (Kilts) on DigitalOcean

While send email network is unreachable

I moved the default "hello.js" files in an archive folder and moved my React App build in the var/www/html folder but I see no changes

Report this

Setting up an ftp user to upload website files

Related questions

Request to Unblock Outbound SMTP Ports 587 and 465

What Is the No.1 Technology Today That Developers Must Master to Build Next-Gen Social Media Apps?

I would like to get information about my account.

How can AI and machine learning personalize content feeds in new social media apps?

How to create a social media app that respects user privacy and builds trust?

AstroJS project hosted on DigitalOcean droplet with Nginx – CSS loading as text/html

What’s the Biggest Technical Challenge You Faced in Messaging App Development — and How Did You Solve It?

Issue with store/landing page not loading properly after migration from Hostinger to DigitalOcean

A tip to optimize the order in the .htaccess file

Deploying a Web App with a Scottish Touch (Kilts) on DigitalOcean

While send email network is unreachable

I moved the default "hello.js" files in an archive folder and moved my React App build in the var/www/html folder but I see no changes