Create restricted user on Ubuntu

Question

I need to grant guest SSH access to some user to review our server. He could:

• access only /opt/www/ folder (and subfolders)
• can list folders
• but can't read files content
• can't edit/create files

How to do this properly?

Answer 1

Use a chroot to achieve the first and suitable file permissions and/or Access Control Lists (ACLs) to achieve the second.

Answer 2

As a partial answer dealing with the file permission part of your question:

You could set the following ACL's so that the somebody user has read and execute permissions on all directories (required to transverse and list the contents) but no permissions on files. They would be unable to see the file exists but unable to list the contents of the file.

find /opt/www/ -type d -exec setfacl -m u:somebody:rX {} \;
find /opt/www/ -type f -exec setfacl -m u:somebody:--- {} \;

Unfortunately this is just a one off fix. The next time somebody add's a file it wont have the correct permissions. You want the default permissions of directories to be read and execute and the default permissions of files to be --- for the somebody user.

To the best of my knowledge you can not have different default permissions for directories and files. You could set a default ACL for the somebody user with rX which would give them read permissions on everything and execute on directories but this would also give them read permission on the newly created files.

I suppose you could do something really hackish like set a cron job to set these ACL's every 5min.

Its also possible that a MAC system such as SELinux might address this issue but I am not sure. I have very minimal experience with them.

[UPDATE]

Here is an article that details setting up chroot for ssh users.

http://allanfeid.com/content/creating-chroot-jail-ssh-access

Once you have a working chroot setup you will want to use the bind option of the mount command to mount the /opt/www directory structure into the chroot.

mount --bind /opt/www /some/path/to/chroot/dir/