CentOS Adding a user restricted to one directory

Question

What's the easiest and standard way to create and restrict a new user to /var/www/ in CentOS ?

Edit: Ideally restricted to SCP only.

Answer 1

With a recent enough CentOS comes a new enough OpenSSH with chroot and internal-sftp features.

First you need to configure OpenSSH to use the internal SFTP. This is done by adding this line to sshd.conf:

Subsystem sftp internal-sftp

Then you can add rules for restricting users / groups to their home directories:

  Match user restrictedjoe
  ChrootDirectory /var/www
  X11Forwarding no
  AllowTcpForwarding no
  ForceCommand internal-sftp

Or for groups

  Match group restrictedgroup
  ChrootDirectory /var/www
  X11Forwarding no
  AllowTcpForwarding no
  ForceCommand internal-sftp

Answer 2

I am not aware of a "stadard way" but one method to do this is to create a so called "jail" for the user where his/her jail is /var/www. This can be done by creating a chroot jail. See the chroot command. The jail can also control what the user can do in the jail ie which commands/programs can be run.

Answer 3

Based on your reply to my comment, I wouldn't give the user a full shell. This makes the task far easier. There are a few shell replacements that come to mind which can be used to allow the user to manage files and nothing else:

• rssh
• scponlyc

I've personally used scponlyc a few times. It even includes scripts to set up chroot jails for you (github wiki)

Answer 4

My favorite why is installing mysecureshell

http://mysecureshell.sourceforge.net/

It's the most config friendly option. You can do a lot of great things with it