let ssh account only access specific directories

Question

If you have an ssh account and a hacker can get his hands on your account then the hacker can almost do anything on your server. Is it possible to limit a ssh account to access only on some specific directories with some limited privileges?

Answer 1

Chroot was already mentioned. But now ssh has it built in for sftp transfers. You can disable shell access all together and use a configuration similar to this one.

Local root exploits are always a problem for distros there are only a few things you can easily do.

• Disable root logins and use sudo.
• Disable password authentication over ssh (use ssh keys with passphrases).
• Make home directories non browsable.
• Don't give out shell accounts if you can help it.

I take this a step further and I run ssh on a random high port to make it harder to find. Anymore specific then this and we'll need to know what distribution your using.

Answer 2

chroot is your best bet.

Answer 3

Just a couple of ideas. You can set up the accounts to use a restricted shell, e.g. /bin/rbash. Alternatively you can try is to add a command=/bin/rbash option to the authorized_keys file.

But all these are just idea. As usual, security is a process...

Answer 4

I would strongly suggest you move to using key pairs (with passphrases to add another factor) for SSH authentication. My /var/log/auth.log is very quiet nowadays.