Right,

It would defenitly help to have the 2 setups documented (either separate or compared against eachother).
I have my information, but I think it would be very helpfull for others.

When starting to configure the jail-kit for the first time, it feels like there are a lot of moving parts. But if you know a bit how things are working with eachother, it helps a lot for the overview. I feel like the additional docuemntation of the difference could help for some people getting this overview.

So what I did (step-by-step) is the following.

for the previous setup I called:
  jk_init -j /jail/dir uidbasics netbasics logbasics cvs git scp sftp ssh rsync extendedshell editors netutils
  (other calls jailing the user etc.)

For fixing:
1. To add the missed but required jk_lsh call:
  jk_init -j /jail/dir jk_lsh

2. Edit the jk_lsh.ini to allow access to the sftp binaries through the jk_lsh (for some reason this is the only accessed shell, eventhough the jk_chroot shell is used for other ssh stuff).
  jk_lsh.ini added content >>
  ```
  [DEFAULT]
  executables = /usr/bin/scp, /usr/lib/sftp-server,
/usr/libexec/openssh/sftp-server, /usr/lib/misc/sftp-server, /usr/libexec/sftp-server, /usr/lib/openssh/sftp-server, /usr/bin/rsync, /usr/bin/ssh
  paths = /usr/bin/, /usr/lib
  allow_word_expansion = 1
  ```
3. Copy the jk_lsh.ini file to the '/jail/dir/etc/jailkit/' (either manually or using:)
  jk_update -j /jail/dir /etc/jailkit/jk_lsh.ini

4. Make sure the global shell configuration for the jailed user is set at 'jk_chrootsh' > i.e. in the '/etc/passwd' file
  usermod -s /usr/sbin/jk_chrootsh jail_user

5. Make sure the shell configuration in the jailed environment for the jailed user is set to the normal shell to make sure 'normal' ssh still works (rather than only restricting to jk_lsh).
  (simplest way is to manually edit the /jail/dir/etc/passwd file)
  jail_user:x:1001:1001:,,,:/home/jail_user:/bin/bash

Hope this makes things clear.
This was my way to fix the issue afterwards, but should be set by making sure the defaults are set correctly (see original post).

Goodday,

I have been strugling to find the problem with getting sftp to work.

I didn't find any good tutorials or documentation to follow, appart from those editing the 'sshd_config' file and so on. So maybe some documentation is in order as well?

In essence most things work right from the start after a 'jk_init' call, unfortunately not sftp.

For one the 'jk_lsh' is not included as 'includesections' in the 'jk_init.ini' file while the sftp utility actually depends on it. I only figured it out through watching the 'auth.log', a place most won't look for debugging.
Secondly, when using the 'jk_lsh' utility, one should edit the 'jk_lsh.ini' file to include the allowed binaries (the sftp binaries in this case). One sidenote is that a 'jk_update' call is required to update the config files in a jail.

I think this is more an improvement rather than a bug? Something which can partially be solved by editing the '.ini' files, and maybe some magic involving auto-adding the sftp executables to the 'jk_lsh.ini' file?

Appart from that, some proper documentation on this would help a lot, since there is not much online documenting this properly.

Kind Regards