CompTIA Linux+ XK0-006 (V8) Practice Question

The correct answer is that the ChrootDirectory path and all of its parent components must be owned by the root user and not be writable by any other user or group. This is a strict security requirement of the OpenSSH daemon to prevent the chrooted user from breaking out of the jail. If /home/user is designated as the chroot directory, both /home and /home/user must be owned by root. Since a user typically needs write access to their own home directory, the standard practice is to create a subdirectory inside the home directory (e.g., /home/user/upload) owned by the user, while the home directory itself remains owned by root. The internal-sftp subsystem does not require a separate sftp-server binary or a user shell like /bin/bash to be present within the jail. Firewall rules would typically prevent the initial connection, not cause a disconnect after authentication.