Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our security policy does not permit ftpd on our servers. Our trusted developers use sftp to access our webservers and they have full access to the server. How do we grant limited access to a single untrusted developer for an existing virtual host. Ive configured rssh to only allow sftp to our untrusted developer, but we dont want him browsing around our other sites. I've investigated chroot, but it seems overly complex and more for restricting access to their home folders. I want to limit access to /srv/www/vhostx/ and below.

Whats the best solution?

share|improve this question
Your post mentions ftps but the tag says sftp. Which is it? Huge difference. sftp would let you use the chroot functionality in OpenSSH's sshd. – Alex Holst May 26 '10 at 12:26
Yes, sorry it was a mistake, I meant sftp. I have edited it. – Michelle May 26 '10 at 12:47
up vote 1 down vote accepted

Use Match, ForceCommand and ChrootDirectory in sshd_config to restrict the user foo to a particular directory:

Match user foo
ForceCommand internal-sftp
ChrootDirectory /srv/www/vhostx/
share|improve this answer
This is the best solution except on Centos 5.x it requires manually upgrading openssh to version 5+. I built openssh 5.2 source rpm's and its all working now! – Michelle May 27 '10 at 7:25

Use sftp, chroot to his home dir, set his home dir to /srv/www/vhostx/. If that's not possible, make a new account for him to use when uploading which does have those settings.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.