Windows OpenSSH SFTP chroot directory user match not working

[zveroboy152]

Troubleshooting steps https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps

Terminal issue? please go through wiki https://github.com/PowerShell/Win32-OpenSSH/wiki/TTY-PTY-support-in-Windows-OpenSSH

Please answer the following

Client OperatingSystem Windows 10 21H2 Enterprise running winSCP

What is failing Matcher User w/ Chroot flag:

Match User tyler.lindberg #AllowTcpForwarding no ChrootDirectory F:\SFTP-Root\SystemOps #ForceCommand internal-sftp

Expected output Land user's matched chroot:

Match User tyler.lindberg #AllowTcpForwarding no ChrootDirectory F:\SFTP-Root\SystemOps #ForceCommand internal-sftp

Actual output

It lands the user in their home directory instead

[vthiebaut10]

What is the version of the OpenSSH client and the server?

[zveroboy152]

Both versions are: 8.9.1.0

I also cannot get SFTP to work.

Try to install OpenSSH-x64-v8.9.1.0.msi (either 32bit or 64) and try to SFTP to it, it does not work.

[isandulache]

I've tried version 8.9.0.0 and 8.9.1.0 and neither one is starting the OpenSSH service when I use Subsystem with the parameter "-d "C:\FTP"" As a workarround i've installed 8.6.0.0 which has no problem starting the server with this configuration.

Here is my conf:

Subsystem	sftp	sftp-server.exe -d "C:\FTP\"
Match User XXX\test
	ChrootDirectory C:\FTP\tmp2					   
	AuthenticationMethods password
	PermitTunnel no
	AllowAgentForwarding no
	AllowTcpForwarding no
	X11Forwarding no

The server OS is Windows Server 2022 Datacenter Azure Edition The client OS is Windows 11 Enterprise, with the latest updates using WinSCP 5.21

[zveroboy152]

Hi @isandulache ,

I was able to get my service to start too, but using a configuration super close to yours, it will only drop the matched user into the "F:\SFTP-Root", not the chroot directory: "F:\SFTP-Root\SystemOps"

Config:

override default of no subsystems

Subsystem sftp sftp-server.exe -d "F:\SFTP-Root"

match User domain\first.last ChrootDirectory F:\SFTP-Root\SystemOps
AuthenticationMethods password PermitTunnel no AllowAgentForwarding no AllowTcpForwarding no X11Forwarding no

[zveroboy152]

Closing since this doesn't work, and won't work ever it seems. :-(

[vthiebaut10]

@zveroboy152 Sorry about the delay to respond. I didn't see that the issue was updated. I will re-open the issue and investigate it further.

[godown70]

I happen to be looking for a solution to this problem too!

I use log debug3 to see the message that sftp-server.exe cannot be found in C:\Windows\System32 I manually copied sftp-server.exe to C:\Windows\System32 restart openssh service you can use sftp mode

hope to help you

[algorithmcorp]

this worked for me.

Subsystem sftp sftp-server.exe -d "C:\Call Center" Match User sftplnig ChrootDirectory "C:\Call Center"
AuthenticationMethods password PermitTunnel no AllowAgentForwarding no AllowTcpForwarding no X11Forwarding no