0

I need freelancers to be able to download and upload files to some of my websites on my Ubuntu server, but not all.

How do I set it up so that each freelancer is a user who has access to only the sites that they should be able to access and nothing else?

I've followed the instructions I found to set up ftp users with access to particular folders via bind. I have added my ftp users to a group that has read, write access permissions to those folders, so all seems good from that perspective - my users can do what they need to do. But my ftp users are able to navigate to all the folders on my server and that is not good at all. How do I make sure that they are limited to their /home/thisuser folder and nothing else.

3 Answers 3

0

I can't comment on your question as I don't have enough reputation yet, but is there a reason you are using FTP instead of SFTP? FTP will send passwords in the clear which is a very bad thing. SFTP will encrypt your exchanges between client and server.

Setting up an SFTP chroot is a several step process. These directions assume you have an ssh server installed.

  1. In /etc/ssh/sshd_config replace the line

    Subsystem sftp /usr/lib/openssh/sftp-server with this:

    Subsystem sftp internal-sftp

    Following this line, add the following section:

    Match group sftponly

    ChrootDirectory /home/%u
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp

    ChrootDirectory /home/%u will force a user's home directory to be the root directory.

  2. Create an sftponly group:

    sudo groupadd sftponly

  3. Add all freelancers to the sftponly group and change the user's home directory:

    sudo usermod -g sftponly -d / johnnyfreelancer

    'sftponly' must be the primary group of the user (this is what the -g flag does), otherwise this method will not work. The -d flag is also necessary because once the user logs in /home/%u will effectively be the topmost directory for the logged in user.

6
  • Is wsftpd an ssh server? Mar 14, 2012 at 19:51
  • Do you mean vsftpd?
    – Evan
    Mar 19, 2012 at 15:02
  • If you do, then no. vsftpd is a FTPS (FTP Secure) server. The above configuration is for SFTP (SSH File Transfer Protocol) on an ssh server.
    – Evan
    Mar 19, 2012 at 15:12
  • Apologies. I did mean vsftpd. Mar 26, 2012 at 9:57
  • I wish I could upvote this answer. I see I asked this more than a year ago. I came today and reimplemented your advice on a new box. Thanks for your help Aug 25, 2013 at 16:10
1

I'd use chroot. That's really your best option as you'll be 100% sure that nobody can view anything else than his "home" directory.

0

I'd use SUphp and make groups for the freelancers. You can then add write/read permission on the folder they need for their group.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .