Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite
1

can I set up

  • a secure ftp for somebody (not a current user on the system)
  • for 2 different directories on Ubuntu
  • inside public_html?

I don't want to give the user pure ssh account right now.

Any other upload,download,delete file secure way is good too. nginx is available not apache2.

share|improve this question

5 Answers

up vote 5 down vote accepted

try using scponly

Edit:

Example set-up:

1) create account for using scponly:

sudo useradd joe

2) change default shell for the account:

sudo chsh joe

answer with /usr/bin/scponly, (make sure that /usr/bin/scponly is in /etc/shells)

3) you can modify joe's home directory to /my/web/site/dir in /etc/passwd

sudo vim /etc/passwd

4) modify permissions:

sudo chgrp -R joe /my/web/site/dir
sudo chmod -R g+w /my/web/site/dir

5) If you are using AllowUsers directive in /etc/ssh/sshd_config add joe to the list of users that can log in.

6) restart ssh:

sudo /etc/init.d/ssh restart

7) test from another host:

scp web_site_stuff.html joe@site.com:
share|improve this answer
@Casual Coder: I like scponly but I am not sure how I can handle the permissions. I want to give access to the installation of Wordpress but I guess I cannot change the permission from www-data to something else. So should I add this new user to www-data group? – Radek Sep 20 '10 at 9:23
You can create for instance scp group, change your scp-accessible dir owner:group to www-data:scp, and grant write permssions to scp group. – Casual Coder Sep 20 '10 at 10:07
would the web server work ok if I change the group permission from www-data? – Radek Sep 20 '10 at 11:51
user www-data is still the owner of the dir and has appropriate permissions. Only group have changed. – Casual Coder Sep 20 '10 at 12:03
Of course you can go with www-data group with write permission and add scpuser (in an example joe) to www-data group, but in my opinion it would be less secure. – Casual Coder Sep 20 '10 at 12:14
show 3 more comments
up vote 1 down vote

Make one home directory for new user then symlink other two dir. in that home dir & give that two folder appropriate permission.

share|improve this answer
up vote 1 down vote

I beleive that you could use rssh to setup a restricted shell to provide access over sftp but not over say ssh. I also beleive that you could "lock" the user to specific folders by using chroot. Here are two links that explains this further:

How to: Restrict Users to SCP and SFTP and Block SSH Shell Access with rssh

Linux Configure rssh Chroot Jail To Lock Users To Their Home Directories Only

Please note that I have actually never done this myself.

Edit: As Zoredache points out it may be a better solution to do the chrooting in the sshd config direcly, instead of doing this in the rssh config as the above link suggests.

share|improve this answer
cool, I'll have a look when I get home! – Radek Sep 20 '10 at 7:07
2  
Those documents almost certainly should not be used for recent versions of SSH which have a built in method for an sftp chroot. – Zoredache Sep 20 '10 at 7:20
1  
yep, looks like an better solution to setup the chroot in sshd_config directly. – Avada Kedavra Sep 20 '10 at 7:46
Avada - that kind of counts as an answer! – dunxd Sep 20 '10 at 10:39
up vote 0 down vote

at the end I used pure-FTPd with TLS support

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.