up vote 3 down vote favorite
1
share [g+] share [fb]

can I set up

  • a secure ftp for somebody (not a current user on the system)
  • for 2 different directories on Ubuntu
  • inside public_html?

I don't want to give the user pure ssh account right now.

Any other upload,download,delete file secure way is good too. nginx is available not apache2.

link|improve this question
86% accept rate
feedback

5 Answers

up vote 4 down vote accepted

try using scponly

Edit:

Example set-up:

1) create account for using scponly:

sudo useradd joe

2) change default shell for the account:

sudo chsh joe

answer with /usr/bin/scponly, (make sure that /usr/bin/scponly is in /etc/shells)

3) you can modify joe's home directory to /my/web/site/dir in /etc/passwd

sudo vim /etc/passwd

4) modify permissions:

sudo chgrp -R joe /my/web/site/dir
sudo chmod -R g+w /my/web/site/dir

5) If you are using AllowUsers directive in /etc/ssh/sshd_config add joe to the list of users that can log in.

6) restart ssh:

sudo /etc/init.d/ssh restart

7) test from another host:

scp web_site_stuff.html joe@site.com:
link|improve this answer
@Casual Coder: I like scponly but I am not sure how I can handle the permissions. I want to give access to the installation of Wordpress but I guess I cannot change the permission from www-data to something else. So should I add this new user to www-data group? – Radek Sep 20 '10 at 9:23
You can create for instance scp group, change your scp-accessible dir owner:group to www-data:scp, and grant write permssions to scp group. – Casual Coder Sep 20 '10 at 10:07
would the web server work ok if I change the group permission from www-data? – Radek Sep 20 '10 at 11:51
user www-data is still the owner of the dir and has appropriate permissions. Only group have changed. – Casual Coder Sep 20 '10 at 12:03
Of course you can go with www-data group with write permission and add scpuser (in an example joe) to www-data group, but in my opinion it would be less secure. – Casual Coder Sep 20 '10 at 12:14
show 3 more comments
feedback
up vote 1 down vote

Make one home directory for new user then symlink other two dir. in that home dir & give that two folder appropriate permission.

link|improve this answer
feedback
up vote 1 down vote

I beleive that you could use rssh to setup a restricted shell to provide access over sftp but not over say ssh. I also beleive that you could "lock" the user to specific folders by using chroot. Here are two links that explains this further:

How to: Restrict Users to SCP and SFTP and Block SSH Shell Access with rssh

Linux Configure rssh Chroot Jail To Lock Users To Their Home Directories Only

Please note that I have actually never done this myself.

Edit: As Zoredache points out it may be a better solution to do the chrooting in the sshd config direcly, instead of doing this in the rssh config as the above link suggests.

link|improve this answer
cool, I'll have a look when I get home! – Radek Sep 20 '10 at 7:07
2  
Those documents almost certainly should not be used for recent versions of SSH which have a built in method for an sftp chroot. – Zoredache Sep 20 '10 at 7:20
1  
yep, looks like an better solution to setup the chroot in sshd_config directly. – Avada Kedavra Sep 20 '10 at 7:46
Avada - that kind of counts as an answer! – dunxd Sep 20 '10 at 10:39
feedback
up vote 0 down vote

at the end I used pure-FTPd with TLS support

link|improve this answer
feedback
up vote 0 down vote

finally I use Limiting Access with SFTP Jails on Debian and Ubuntu

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.