Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to create a user that have only access to the following directories and can't see nothing else

/home/vehicles/ #read only
/home/images/  #read only
/home/dump/ #read and write

I used this link http://unix.stackexchange.com/questions/15360/how-to-add-a-ssh-user-who-only-has-permissions-to-access-specific-folder

so that I create a user group called testserver

 Match Group testserver
        ChrootDirectory %h
        AllowTCPForwarding no
        X11Forwarding no
        ForceCommand internal-sftp

and the chmod of those folders like the following

chmod -R 755 /home/vehicles/
chmod -R 755 /home/images/
chmod -R 765 /home/dump/

Everything went good except that testuser is still able to access other folders, how I prevent this user from accessing other folder(i.e only access those three folders)

share|improve this question

migrated from stackoverflow.com Oct 30 '11 at 11:33

This question came from our site for professional and enthusiast programmers.

    
ChrootDirectory only works if the target directory is owned by root -- and unless the home directory of testuser is /home itself that'll just lock them into their home directory. –  Shadur Oct 30 '11 at 13:06

2 Answers 2

Okay, first off, change that directory structure to:

/home/testserver/vehicles
/home/testserver/images
/home/testserver/dump

Then execute

chown root.root /home/testserver /home/testserver/vehicles /home/testserver/images
chmod 755 /home/testserver
chown testuser.testserver /home/testserver/dump
chmod 775 /home/testserver/dump 

Finally, alter the ChrootDirectory directive line in /etc/ssh/sshd_config to

ChrootDirectory /home/testserver

I also recommend that you do a great deal of reading and brushing up on linux system administration in general, as your question and the things you attempted to do so far indicate "cargo cult" administration -- copy/pasting advanced administration tricks without understanding what they do or how they do it in the hope that they'll do what you want. This can very easily lead to disasters that you'll have no idea how to fix.

share|improve this answer
    
Thanks a lot for your answer But it still can access other files, I there exist a way to block this user from accessing anything else except /home/testserver/?? –  alex CSD Oct 31 '11 at 9:29
    
Is /home/testserver/ owned by root.root ? –  Shadur Oct 31 '11 at 9:42
    
yes, but dump folder is owned by testuser –  alex CSD Oct 31 '11 at 10:10
    
If you set up the ChrootDirectory /home/testserver directive and that directory is owned by root then the internal-sftp force command should keep it properly rooted in /home/testserver and only able to access /dump/, /vehicles/ and /images/ –  Shadur Oct 31 '11 at 10:13
    
yes when I logged in, it directs me to /home/testuser then I changed the directory to the parent folder cd /home and suddenly I am able to access any folder according to it's permission for example those folders drwx---r-x 5 root root 4096 Oct 25 08:00 lib_dataDownloader drwx---r-x 2 root root 4096 Oct 24 07:54 localX –  alex CSD Oct 31 '11 at 10:19

Remove testuser from the groups users and any other groups, as well as use grsecurity path to define your RBAC lists.

If you intend to login with testuser then it needs rights to /bin and others, like /proc.

share|improve this answer
    
Sorry could you please give me some extra details as I am new at Linux system –  alex CSD Oct 30 '11 at 11:07
    
btw when I execute the following command egrep -i "^testuser" /etc/passwd it's output testuser:x:1002:1003:Test User,,,:/home/testuser:/bin/bash –  alex CSD Oct 30 '11 at 11:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.