3

can I set up

  • a secure ftp for somebody (not a current user on the system)
  • for 2 different directories on Ubuntu
  • inside public_html?

I don't want to give the user pure ssh account right now.

Any other upload,download,delete file secure way is good too. nginx is available not apache2.

5 Answers 5

5

try using scponly

Edit:

Example set-up:

1) create account for using scponly:

sudo useradd joe

2) change default shell for the account:

sudo chsh joe

answer with /usr/bin/scponly, (make sure that /usr/bin/scponly is in /etc/shells)

3) you can modify joe's home directory to /my/web/site/dir in /etc/passwd

sudo vim /etc/passwd

4) modify permissions:

sudo chgrp -R joe /my/web/site/dir
sudo chmod -R g+w /my/web/site/dir

5) If you are using AllowUsers directive in /etc/ssh/sshd_config add joe to the list of users that can log in.

6) restart ssh:

sudo /etc/init.d/ssh restart

7) test from another host:

scp web_site_stuff.html [email protected]:
8
  • @Casual Coder: I like scponly but I am not sure how I can handle the permissions. I want to give access to the installation of Wordpress but I guess I cannot change the permission from www-data to something else. So should I add this new user to www-data group?
    – Radek
    Sep 20, 2010 at 9:23
  • You can create for instance scp group, change your scp-accessible dir owner:group to www-data:scp, and grant write permssions to scp group. Sep 20, 2010 at 10:07
  • would the web server work ok if I change the group permission from www-data?
    – Radek
    Sep 20, 2010 at 11:51
  • user www-data is still the owner of the dir and has appropriate permissions. Only group have changed. Sep 20, 2010 at 12:03
  • Of course you can go with www-data group with write permission and add scpuser (in an example joe) to www-data group, but in my opinion it would be less secure. Sep 20, 2010 at 12:14
1

Make one home directory for new user then symlink other two dir. in that home dir & give that two folder appropriate permission.

1

I beleive that you could use rssh to setup a restricted shell to provide access over sftp but not over say ssh. I also beleive that you could "lock" the user to specific folders by using chroot. Here are two links that explains this further:

How to: Restrict Users to SCP and SFTP and Block SSH Shell Access with rssh

Linux Configure rssh Chroot Jail To Lock Users To Their Home Directories Only

Please note that I have actually never done this myself.

Edit: As Zoredache points out it may be a better solution to do the chrooting in the sshd config direcly, instead of doing this in the rssh config as the above link suggests.

4
  • cool, I'll have a look when I get home!
    – Radek
    Sep 20, 2010 at 7:07
  • 2
    Those documents almost certainly should not be used for recent versions of SSH which have a built in method for an sftp chroot.
    – Zoredache
    Sep 20, 2010 at 7:20
  • 1
    yep, looks like an better solution to setup the chroot in sshd_config directly. Sep 20, 2010 at 7:46
  • Avada - that kind of counts as an answer!
    – dunxd
    Sep 20, 2010 at 10:39
1

finally I use Limiting Access with SFTP Jails on Debian and Ubuntu

1
  • Looks like a nice explanation but it does not work for me on Ubuntu 14.04. Aug 17, 2015 at 21:41
0

at the end I used pure-FTPd with TLS support

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .