Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What's the easiest and standard way to create and restrict a new user to /var/www/ in CentOS ?

Edit: Ideally restricted to SCP only.

share|improve this question
Will this user have shell access, or do they simply need to be able to put files in /var/www? – Kyle Smith Mar 19 '12 at 11:14
Ideally restricted to SCP only I reckon. Thanks. – David Wadge Mar 19 '12 at 11:53
up vote 4 down vote accepted

With a recent enough CentOS comes a new enough OpenSSH with chroot and internal-sftp features.

First you need to configure OpenSSH to use the internal SFTP. This is done by adding this line to sshd.conf:

Subsystem sftp internal-sftp

Then you can add rules for restricting users / groups to their home directories:

  Match user restrictedjoe
  ChrootDirectory /var/www
  X11Forwarding no
  AllowTcpForwarding no
  ForceCommand internal-sftp

Or for groups

  Match group restrictedgroup
  ChrootDirectory /var/www
  X11Forwarding no
  AllowTcpForwarding no
  ForceCommand internal-sftp
share|improve this answer

I am not aware of a "stadard way" but one method to do this is to create a so called "jail" for the user where his/her jail is /var/www. This can be done by creating a chroot jail. See the chroot command. The jail can also control what the user can do in the jail ie which commands/programs can be run.

share|improve this answer

Based on your reply to my comment, I wouldn't give the user a full shell. This makes the task far easier. There are a few shell replacements that come to mind which can be used to allow the user to manage files and nothing else:

I've personally used scponlyc a few times. It even includes scripts to set up chroot jails for you (github wiki)

share|improve this answer

My favorite why is installing mysecureshell

It's the most config friendly option. You can do a lot of great things with it

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.