Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Debian server, and I want to give several users read only access to a subtree of folders on that server. Is there a way to do this without manually changing the rights of all files and folders?

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

If you really want to restrict them down as much as possible, I suggest looking at a chrooted ssh install. That way even if they did manage to break out their tree they wont be able to trawl around the underlying system.

The Debian guys have a guide available on the subject.

share|improve this answer
1  
One link for it is howtoforge.com/chrooted_ssh_howto_debian –  Andy May 26 '09 at 10:11
1  
debian.org/doc/manuals/securing-debian-howto/… for the debian manual one. –  Andrew Williams May 26 '09 at 10:25
add comment

the original (from openbsd) sshd can do a full chroot, quoting from sshd_config:

ChrootDirectory

         Specifies a path to chroot(2) to after authentication.  This
         path, and all its components, must be root-owned directories that
         are not writable by any other user or group.  After the chroot,
         sshd(8) changes the working directory to the user's home directo-
         ry.

         The path may contain the following tokens that are expanded at
         runtime once the connecting user has been authenticated: %% is
         replaced by a literal '%', %h is replaced by the home directory
         of the user being authenticated, and %u is replaced by the user-
         name of that user.

         The ChrootDirectory must contain the necessary files and directo-
         ries to support the user's session.  For an interactive session
         this requires at least a shell, typically sh(1), and basic /dev
         nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4),
         arandom(4) and tty(4) devices.  For file transfer sessions using
         ``sftp'', no additional configuration of the environment is nec-
         essary if the in-process sftp server is used, though sessions
         which use logging do require /dev/log inside the chroot directory
         (see sftp-server(8) for details).

         The default is not to chroot(2).
share|improve this answer
add comment

rssh does exactly that. From pizzashack.org:

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that. For a list of platforms on which rssh is known to work, see the Platform Support Page.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.