Multiple different users to different directories

[mattyx0011]

We have a question we'd like to seek advice on.
We're using Windows IIS to establish SFTP, and our goal is to enable different users: sftp-1, sftp-2, sftp-3 to directly access D:\sftp\1, E:\sftp\2, F:\sftp\3, respectively. Could editing the sshd_config in OpenSSH help us achieve this objective.
Currently, I'm stuck as I can only set one ChrootDirectory, and attempting to configure multiple sets of SSH services results in failure to start.
Thanks.

[mattyx0011]

Supplementing the attempted configurations

Match User sftp-1
	ChrootDirectory "D:\sftp\1"
	AllowTcpForwarding no
Match Group FTP_Group
	ChrootDirectory "E:\sftp\2"
	AllowTcpForwarding no

But It's not working

[alexeig]

Match Group FTP_Group

This will not work for at least one reason:

1. Arguments in Match Group, Match User, AllowGroups and similar directives must be lower case - see "Match" and "All account names must be specified in lower case." in "AllowGroups, AllowUsers, DenyGroups, DenyUsers"
2. In my experiments, openssh/sftp starts behaving unpredictably and denying access to pretty much everyone (but not always!) with the mere presence of a Match Group directive in sshd_config - even for user accounts not affected by the directive. (Tried on two WS2019 VMs.)

So try this:
Match Group ftp_group
... yet you might have better luck with Match User instead.

---

Currently, I'm stuck as I can only set one ChrootDirectory, and attempting to configure multiple sets of SSH services results in failure to start.

This is working for me, in sshd_config:

AllowUsers ftp_user1 administrator

Match User ftp_user1
	ChrootDirectory %h\Documents\

Match User administrator
	ChrootDirectory %h\

(Don't have to use %h (user's home directory) or %u (username) tokens - hard-wired paths like ChrootDirectory C:\Users\SFTP_Users\ will work, too.)

Below are sftp sessions to those two accounts from a random client on the network. They show that the users are indeed "jailed" to their home directories, and that the two different Match User directives both work.

PS> sftp ftp_user1@testsrvr
ftp_user1@testsrvr's password:
Connected to testsrvr.
sftp> ls
My Music            My Pictures         My Videos           Visual Studio 2017
sftp> pwd
Remote working directory: /
sftp> bye
PS>

PS> sftp administrator@testsrvr
administrator@testsrvr's password:
Connected to testsrvr.
sftp> pwd
Remote working directory: /
sftp> ls
3D Objects
AppData
Application Data
Contacts
Cookies
Desktop
Documents
Downloads
Favorites
Links
Local Settings
Music
My Documents
NTUSER.DAT
NTUSER.DAT{****}.TM.blf
NTUSER.DAT{****}.TMContainer00000000000000000001.regtrans-ms
NTUSER.DAT{****}.TMContainer00000000000000000002.regtrans-ms
NetHood
Pictures
PrintHood
Recent
Saved Games
Searches
SendTo
Start Menu
Templates
Videos
ntuser.dat.LOG1
ntuser.dat.LOG2
ntuser.ini
sftp> bye

Try this and let us know if it works for you? Any questions - let me know.