Jailed user shell directory

[systeq]

SYSTEM INFORMATION
OS type and version	Rocky Linux 9
Virtualmin version	7.40.0

I’m having issues with sftp access for users. When a new user is created by VirtualMin it sets the shell directory to /sbin/jk_chrootsh. The user gets access denied when trying to connect via SFTP.

If I change the users shell to /usr/sbin/jk_chrootsh (done through webmin) the user can then log in.

That would be fine, except any change to the user account through VirtualMin results in the path being reset and the user losing access again until I manually set it back.

/sbin is a symlink to /usr/sbin so I don’t really understand why one works and the other doesn’t, however is there a way to set the dafault path VirtualMin uses? If I could get it to default to /usr/sbin/jk_chrootsh instead of /sbin/jk_chrootsh that would resolve the issue.

[stefan1959]

What port are they using for sftp?

[systeq]

Port 2222 which I assume is correct, as I say it works fine if I change the shell location for the user account.

I thought it was just an issue with that server, but I now have 2 installs and both have the same problem

[stefan1959]

Logs are you best bet to find the issue, check /var/logs/proftp directory for any dropped logs.

Check the docs, the pro version and a section for allowing extra command and directories and writes to the /etc/jailkit/jk_init.ini file.
Does the file exist and if it does you may need to allow sftp.
BTW I know very little about jailing as I don’t use it so I maybe way off here.

[systeq]

Ok thanks I’ll take a look, though I stil think it’s more an issue with the Virtualmin config than proftp. If I could configure it to use the correct path by default it wouldn’t be a problem.

[verne]

some say Virtualmin has so much isolation already that jailkit with all its headaches just doesn’t add much of anything more to the game …

… have you considered if jailkit is really needed?

[systeq]

We have individual projects and the data needs to be completely isolated, so users need to be confined to their home directories

[systeq]

As I’m using GPL not Pro I don’t have those additional options unfortunately.

In the logs we just see Invalid shell:
2025-10-06 09:44:27,538 mod_sftp/1.1.1[429431]: authentication for user failed: Invalid shell

Which fits with what we already know to some extent.

[stefan1959]

yeah I know, just saying the file pro changes is /etc/jailkit/jk_init.ini
Unless pro is doing something with different jailkit then you should be able to edit this manually.