Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to use SFTP on Linux and restrict a user account to ONE directory such that no other directory listing can be obtained? Yes, I must use SFTP, FTP is only used by people that love getting hacked.

For instance I want someone to modify files in /var/www/code/ but I don't want them to be able modify anything else. I don't even want them to see the contents /tmp/.

(I will accept a "quick and dirty" solution, as long as it is secure.)

share|improve this question

5 Answers 5

up vote 4 down vote accepted

From sshd_config man-page:

ChrootDirectory
             Specifies a path to chroot(2) to after authentication.  This
             path, and all its components, must be root-owned directories that
             are not writable by any other user or group.  After the chroot,
             sshd(8) changes the working directory to the user's home directo-
             ry.

             The path may contain the following tokens that are expanded at
             runtime once the connecting user has been authenticated: %% is
             replaced by a literal '%', %h is replaced by the home directory
             of the user being authenticated, and %u is replaced by the user-
             name of that user.

             The ChrootDirectory must contain the necessary files and directo-
             ries to support the user's session.  For an interactive session
             this requires at least a shell, typically sh(1), and basic /dev
             nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4),
             arandom(4) and tty(4) devices.  For file transfer sessions using
             ``sftp'', no additional configuration of the environment is nec-
             essary if the in-process sftp server is used, though sessions
             which use logging do require /dev/log inside the chroot directory
             (see sftp-server(8) for details).

             The default is not to chroot(2).
share|improve this answer

Another alternative could also be to replace their shell with MySecureShell which gives you features such as Chroot, Bandwidth limiting, Connection limiting, etc.. etc..

http://mysecureshell.sourceforge.net/

Using it in a webhosting environment at the moment and must say it's worked out quite nicely.

share|improve this answer

SFTP is NOT a feature-rich solution comparable to an FTP server like vsftpd. It doesn't support chroots; which is what you are looking for. FTPS (not SFTP) would be the best solution since it supports encryption, chroots, etc. vsftpd supports this and it's easy to setup.

In addition be sure to take advantage of the pam_listfile module to explicitly state which users are allowed to login via ftps.

share|improve this answer
    
OpenSSH has had built-in chroot support for years. –  Alex Holst Feb 13 '10 at 21:00
    
I stand corrected, my apologies. What directive do you use to allow a given user chrooted sftp access while barring them ssh/scp access? –  CarpeNoctem Feb 13 '10 at 21:26
    
Set the users shell to sftp-server. –  Alex Holst Feb 13 '10 at 22:11

http://pizzashack.org/rssh/ lets you set up restricted ssh so that only SFTP/SCP are run; it also helps setting up the chroot.

As CarpeNoctem points out, FTPS sometimes is a better solution. ssh, SFTP, scp are very "low-level", FTPS (like the unsafe FTP) are normally higher-level (virtual directories, virtual users, etc.).

I think for the scenario you describe, both approaches would work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.