Como limitar um usuário a sua pasta?

Question

Eu quero que um usuário acesse apenas seu diretório. Então eu tenho que adicionar as seguintes linhas para / etc / ssh / sshd_config

Subsystem sftp internal-sftp
Match Group sftp
        ChrootDirectory /home/%u
        ForceCommand internal-sftp
        AllowTcpForwarding no

Quando eu reiniciar o SSH:

service ssh restart

O seguinte erro é exibido:

Job for ssh.service failed because the control process exited with error code. See "systemctl status ssh.service" and "journalctl -xe" for details.

Mais detalhes:

 ssh.service - OpenBSD Secure Shell server
   Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sat 2016-12-10 19:07:57 CET; 27s ago
  Process: 1928 ExecStart=/usr/sbin/sshd -D $SSHD_OPTS (code=exited, status=255)
 Main PID: 1928 (code=exited, status=255)

Dec 10 19:07:57 vps307796 systemd[1]: Starting OpenBSD Secure Shell server...
Dec 10 19:07:57 vps307796 sshd[1928]: /etc/ssh/sshd_config line 93: Directive 'UsePAM' is not allowed within
Dec 10 19:07:57 vps307796 systemd[1]: ssh.service: Main process exited, code=exited, status=255/n/a
Dec 10 19:07:57 vps307796 systemd[1]: Failed to start OpenBSD Secure Shell server.
Dec 10 19:07:57 vps307796 systemd[1]: ssh.service: Unit entered failed state.
Dec 10 19:07:57 vps307796 systemd[1]: ssh.service: Failed with result 'exit-code'.

A resposta de "Jakuje" corrige o erro. Mas eu não consigo me conectar com um cliente ftp:

#  Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

        Match Group sftp
        ChrootDirectory /home/%u
        ForceCommand internal-sftp
        AllowTcpForwarding no

    

Answer 1

...: /etc/ssh/sshd_config line 93: Directive 'UsePAM' is not allowed within

... bloco de correspondência.

Você escreveu o snippet da configuração em algum lugar antes da linha 93 e, portanto, a opção UsePam também entrou nesse bloco. Mova seu snippet criado ( Match Group ... ) para o final do arquivo e você deve ser bom.