连接到主机的Jailkit失败的sftp (退出状态4)

Question

我正在使用Jailkit 2.21运行UbuntuServer18.04，希望允许一些用户通过密码访问chrooted /sftp。

sftp客户端可以验证OK，但只需断开与“退出状态4”的连接，我看到“连接到主机失败”：

sftp -v user1@some.hostname.com

debug1: match: OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to some.hostname.com:22 as 'user1'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:z2aXPqeA9saacFJ6QSSW1bxAvAD92RVhL8KLJWG/Fwo
debug1: Host 'some.hostname.com' is known and matches the ECDSA host key.

... local ssh key stuff... 

debug1: Next authentication method: password
user1@some.hostname.com's password: 
debug1: Authentication succeeded (password).
Authenticated to some.hostname.com ([x.x.x.x]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending environment.
debug1: Sending env LANG = en_GB.UTF-8
debug1: Sending subsystem: sftp
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
debug1: channel 0: free: client-session, nchannels 1
debug1: fd 0 clearing O_NONBLOCK
Transferred: sent 2760, received 2328 bytes, in 2.8 seconds
Bytes per second: sent 990.6, received 835.5
debug1: Exit status 4
Connection closed.

在服务器(grep -i sftp /var/log/auth.log)上，当他们登录时，我会看到这一点：

Feb 18 12:28:12 host jk_chrootsh[9462]: now entering jail /home/chroot_scp for user user1 (2933) with arguments -c /usr/lib/openssh/sftp-server

据我所知没有任何错误。/ home /chroot_scp的权限使用jk_check签出OK，用户主页由他们和他们的组拥有。

服务器的sshd_config是：

PermitRootLogin no 
PubkeyAuthentication yes
PasswordAuthentication no 
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem       sftp    /usr/lib/openssh/sftp-server
AllowGroups ssh scp
Match Group scp
     PasswordAuthentication yes

如果我用/bin/bash临时替换用户的shell，他们可以按预期的方式登录。所以我想这和色度有关。

Answer 1

grep jail /var/log/auth.log显示：

Feb 18 14:36:41 host jk_lsh[21784]: WARNING: user user1 (2933) tried to run '/usr/lib/openssh/sftp-server', which is not allowed according to /etc/jailkit/jk_lsh.ini

我在jk_lsh.ini文件中找到了通向sftp服务器的错误路径。