Why can't I get permission to write in sftp and how can I make it write?

Question

linux

Hello.
What I want to achieve:
Have a user who, when connected via sftp, he immediately got into the directory allowed to him and could do anything, but did not go beyond that directory (he did not even see the contents of those directories). I need this to work without mount and without ln
Here are the commands I do:

addgroup –-system sftpusers
nano /etc/ssh/sshd_config
#там я пишу
Subsystem sftp internal-sftp
Match Group sftpusers
ChrootDirectory %h
ForceCommand internal-sftp -u 0007
AllowTcpForwarding no
X11Forwarding no

#далее продолжаем
useradd -d /var/www/mysite.com -s /bin/false -g sftpusers user4 
passwd user4

mkdir /var/www
mkdir /var/www/mysite.com

find /var/www/mysite.com -type f -exec chmod 660 {} \;
find /var/www/mysite.com -type d -exec chmod 770 {} \;
chown -R user4:sftpusers /var/www/mysite.com;
chmod 755 /var/www/mysite.com;
chown root:root /var/www/mysite.com;

systemctl restart sshd

After all these commands, when connecting, the user gets to the /var/www/mysite.com folder, but he cannot do anything there. Partially I guess that the reason is the command chown root:root /var/www/mysite.com; , however, without it, the user cannot connect to the file system at all.

Tell me what needs to be done so that everything works and I can edit the mysite.com folder from the user4 user?

ps this article was taken as the basis of my commands: https://wiki.dieg.info/sftp

Answer 1

It is necessary that the ChrootDirectory be owned by root:root and that the user cannot create anything in it.
useradd -d /var/www -s /bin/false -g sftpusers user4 The subdirectory
that the user needs must have their permissions.
chown -R user4:sftpusers /var/www/mysite.com