Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm creating a webserver, and I will have many users ssh/sftp into it. All they need to do is within their home directory, for example, /home/user/.

Many people have told me to use chroot, but it seems like it's a little bit too much, plus I'm going to have multiple users log in into the server so it'll be just a huge load on the server.

So to recap, I want to prevent users from leaving their home directory, /home/user/. Is this possible?

share|improve this question
    
It is with chroot.. –  Tim Brigham Jan 18 '12 at 22:30
    
Would you recommend chroot with multiple users on the server? –  samwell Jan 18 '12 at 22:31

2 Answers 2

Why would chroot be a "huge load on the server"? This is precisely what chroot was designed to do. There are guides aplenty on the internets that you can follow to get things set up.

share|improve this answer
    
I read that it can slow down the server and take more memory. Would you recommend it with multiple users ssh/sftp into the server? –  samwell Jan 19 '12 at 4:31
    
It's likely that things will be just fine. Just give it a try. If it doesn't end up working, nothing has been lost. –  EEAA Jan 19 '12 at 4:36
    
its not a CPU load, but it requires each user to essentially have their own os install in their home directory. Otherwise an ssh user chrooted to their $HOME directory is pretty much not able to do anything. (like they couldn't run ls or cat since those require access to /bin and /lib) –  stew Jan 19 '12 at 15:29

SSH has built in chroot features for sftp, with ssh its a bit trickier since the users get to start a fully shell, but its also possible. Check out this howto:
http://www.howtoforge.com/chrooted-ssh-sftp-tutorial-debian-lenny

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.