Can I limit SSH access to a particular folder on a cPanel server?

Question

I have a cPanel server and I want to allow a user SSH/SFTP/SCP access to just one paticular folder, is this possible?

I've already set them up with FTP access to this folder, but SSH access would be preferable.

Any suggestions welcome.

Answer 1

SSH intrinsictly needs some system parts on the other side, so this is harder than you think. Instead of being a protocol like ftp that just sort of handles files for you, it's actually a remote shell getting you INTO the machine where you can run commands. This sort of pre-supposes that there is a machine to be gotten into. If you try to limit connections to specific folders you kind of take away the machine and SSH stops being useful.

The solution is called chroot, for "change root". Basically you need to make a little "bubble" folder in which has your files and the basic outlines of a system including some commands and libraries. It's called a "chroot jail" in that it's a little self sustaining cell that you can lock people in so they can't mess with the host system but can do a few things as if they had a shell.

However, chroot jails are a pain to setup and manage and if you're a cpanel user I'm kind of going to guess this is more work than you want to put into it.

The one shortcut you might be able to use is that many ssh daemons have sftp daemons built in that use the transport and authentication security of ssh without giving you the shell part when you get in, just an ftp like system. Unfortunatly you will have to jump through some hoops to make sure that the scp/ssh bits are also DISABLED. It's actually pretty tricky to not give people shells but give them chroot'ed sftp access.

I don't know how to do this on cPanel but at least maybe this will give you a direction to start looking.

EDIT: A little bit of searching turned up that cPanel has some chroot configs built in. It calls it jailshell. You might want to look into that!

Answer 2

Don't do chroot by hand. It's hard and could lead to security holes.

Jailkit is the toolset designed for this exact purpose, to jail an user. Very easy to setup.

http://olivier.sessink.nl/jailkit/

Answer 3

I ended up just creating a new cPanel account and put the files I wanted them to access within there. Thanks for the answers though, understand more about Chroot!

Answer 4

I think you could use a restricted shell, which limits everything to a custom directory. It will simply refuse to deal with things outside it.