3

I have a VPS running Ubuntu 10.04, and I'd like to give someone SFTP access to a single directory, but prevent them from seeing anything else on the system. What's the best way to pull this off?

I considered removing "everyone" permissions from everything on the system, but that seems like a really blunt tool for this problem (and one that'll cause other issues) - I'm hoping there's a better option here.

Edit: I appreciate the answers! (And I learned a bunch reading/researching through them). I ended up finding and using this guide from Linode as it spelled all the steps: http://library.linode.com/security/sftp-jails/

Improve this question
0

3 Answers 3

Reset to default
2

Best way use ftps and chroot(vsftpd) or web-dav with ssl(Apache2,nginx).

Generate a Certificate :

openssl req -x509 -nodes -days 365 -newkey rsa:1024  -keyout /etc/vsftpd/vsftpd.pem   -out /etc/vsftpd/vsftpd.pem

Edit config:

 ssl_enable=YES
 rsa_cert_file=/etc/vsftpd/vsftpd.pem
 chroot_local_user=YES
Improve this answer
2
  • That is FTPs not SFTP as OP asked.
    – Hrvoje Špoljar
    Feb 24, 2011 at 17:42
  • @Hrvoje Easy and reliable install ftps.
    – ooshro
    Feb 24, 2011 at 17:46
1

If you want SFTP which is subsystem of SSH check out this guide here

If you want FTP with SSL layer than ooshro suggestion is fine.

Improve this answer
1

With Ubuntu you can use scponly fairly easily

sudo apt-get install scponly
sudo dpkg-reconfigure -plow scponly

Once it's installed and configured you can use the supplied script to create the user accounts and jails.

cd /usr/share/doc/scponly/setup_chroot
sudo gunzip setup_chroot.sh.gz
sudo chmod +x setup_chroot.sh
sudo ./setup_chroot.sh

Follow the onscreen prompts to configure the user.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .