Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a cPanel server and I want to allow a user SSH/SFTP/SCP access to just one paticular folder, is this possible?

I've already set them up with FTP access to this folder, but SSH access would be preferable.

Any suggestions welcome.

share|improve this question
    
What OS are you using? –  dunxd Oct 20 '10 at 13:54
    
forgot to mention that, CentOS 5.5 –  Adam Dempsey Oct 20 '10 at 21:44

4 Answers 4

up vote 5 down vote accepted

SSH intrinsictly needs some system parts on the other side, so this is harder than you think. Instead of being a protocol like ftp that just sort of handles files for you, it's actually a remote shell getting you INTO the machine where you can run commands. This sort of pre-supposes that there is a machine to be gotten into. If you try to limit connections to specific folders you kind of take away the machine and SSH stops being useful.

The solution is called chroot, for "change root". Basically you need to make a little "bubble" folder in which has your files and the basic outlines of a system including some commands and libraries. It's called a "chroot jail" in that it's a little self sustaining cell that you can lock people in so they can't mess with the host system but can do a few things as if they had a shell.

However, chroot jails are a pain to setup and manage and if you're a cpanel user I'm kind of going to guess this is more work than you want to put into it.

The one shortcut you might be able to use is that many ssh daemons have sftp daemons built in that use the transport and authentication security of ssh without giving you the shell part when you get in, just an ftp like system. Unfortunatly you will have to jump through some hoops to make sure that the scp/ssh bits are also DISABLED. It's actually pretty tricky to not give people shells but give them chroot'ed sftp access.

I don't know how to do this on cPanel but at least maybe this will give you a direction to start looking.

EDIT: A little bit of searching turned up that cPanel has some chroot configs built in. It calls it jailshell. You might want to look into that!

share|improve this answer
    
You might want to look for "jailshell". I found some references that lead me to believe cPanel has something built in for configuring chroots! –  Caleb Oct 20 '10 at 21:31
    
Openssh versions greater than 4.8p1 have chroot support built in for sftp, you can limit a user to a particular directory –  topdog Oct 22 '10 at 13:39

Don't do chroot by hand. It's hard and could lead to security holes.

Jailkit is the toolset designed for this exact purpose, to jail an user. Very easy to setup.

http://olivier.sessink.nl/jailkit/

share|improve this answer

I ended up just creating a new cPanel account and put the files I wanted them to access within there. Thanks for the answers though, understand more about Chroot!

share|improve this answer

I think you could use a restricted shell, which limits everything to a custom directory. It will simply refuse to deal with things outside it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.