Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a VPS running Ubuntu 10.04, and I'd like to give someone SFTP access to a single directory, but prevent them from seeing anything else on the system. What's the best way to pull this off?

I considered removing "everyone" permissions from everything on the system, but that seems like a really blunt tool for this problem (and one that'll cause other issues) - I'm hoping there's a better option here.

Edit: I appreciate the answers! (And I learned a bunch reading/researching through them). I ended up finding and using this guide from Linode as it spelled all the steps: http://library.linode.com/security/sftp-jails/

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Best way use ftps and chroot(vsftpd) or web-dav with ssl(Apache2,nginx).

Generate a Certificate :

openssl req -x509 -nodes -days 365 -newkey rsa:1024  -keyout /etc/vsftpd/vsftpd.pem   -out /etc/vsftpd/vsftpd.pem

Edit config:

 ssl_enable=YES
 rsa_cert_file=/etc/vsftpd/vsftpd.pem
 chroot_local_user=YES
share|improve this answer
    
That is FTPs not SFTP as OP asked. –  Hrvoje Špoljar Feb 24 '11 at 17:42
    
@Hrvoje Easy and reliable install ftps. –  ooshro Feb 24 '11 at 17:46

If you want SFTP which is subsystem of SSH check out this guide here

If you want FTP with SSL layer than ooshro suggestion is fine.

share|improve this answer

With Ubuntu you can use scponly fairly easily

sudo apt-get install scponly
sudo dpkg-reconfigure -plow scponly

Once it's installed and configured you can use the supplied script to create the user accounts and jails.

cd /usr/share/doc/scponly/setup_chroot
sudo gunzip setup_chroot.sh.gz
sudo chmod +x setup_chroot.sh
sudo ./setup_chroot.sh

Follow the onscreen prompts to configure the user.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.