0

Our security policy does not permit ftpd on our servers. Our trusted developers use sftp to access our webservers and they have full access to the server. How do we grant limited access to a single untrusted developer for an existing virtual host. Ive configured rssh to only allow sftp to our untrusted developer, but we dont want him browsing around our other sites. I've investigated chroot, but it seems overly complex and more for restricting access to their home folders. I want to limit access to /srv/www/vhostx/ and below.

Whats the best solution?

2
  • 1
    Your post mentions ftps but the tag says sftp. Which is it? Huge difference. sftp would let you use the chroot functionality in OpenSSH's sshd.
    – Alex Holst
    May 26, 2010 at 12:26
  • Yes, sorry it was a mistake, I meant sftp. I have edited it.
    – Michelle
    May 26, 2010 at 12:47

2 Answers 2

1

Use Match, ForceCommand and ChrootDirectory in sshd_config to restrict the user foo to a particular directory:

Match user foo
ForceCommand internal-sftp
ChrootDirectory /srv/www/vhostx/
1
  • This is the best solution except on Centos 5.x it requires manually upgrading openssh to version 5+. I built openssh 5.2 source rpm's and its all working now!
    – Michelle
    May 27, 2010 at 7:25
0

Use sftp, chroot to his home dir, set his home dir to /srv/www/vhostx/. If that's not possible, make a new account for him to use when uploading which does have those settings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .