Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If you have an ssh account and a hacker can get his hands on your account then the hacker can almost do anything on your server. Is it possible to limit a ssh account to access only on some specific directories with some limited privileges?

share|improve this question
up vote 3 down vote accepted

Chroot was already mentioned. But now ssh has it built in for sftp transfers. You can disable shell access all together and use a configuration similar to this one.

Local root exploits are always a problem for distros there are only a few things you can easily do.

  • Disable root logins and use sudo.
  • Disable password authentication over ssh (use ssh keys with passphrases).
  • Make home directories non browsable.
  • Don't give out shell accounts if you can help it.

I take this a step further and I run ssh on a random high port to make it harder to find. Anymore specific then this and we'll need to know what distribution your using.

share|improve this answer
Nice description. I was busy at work when I posted, but wanted to point the OP in the right direction. – David Rickman Apr 17 '10 at 1:16

chroot is your best bet.

share|improve this answer

Just a couple of ideas. You can set up the accounts to use a restricted shell, e.g. /bin/rbash. Alternatively you can try is to add a command=/bin/rbash option to the authorized_keys file.

But all these are just idea. As usual, security is a process...

share|improve this answer

I would strongly suggest you move to using key pairs (with passphrases to add another factor) for SSH authentication. My /var/log/auth.log is very quiet nowadays.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.