Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been contemplating ways to restrict user access to their own directories, not allowing them to navigate above their own user directory.

I'm using SFTP, and don't want to install regular FTP because of all of the extra security problems that introduces.

rbash sounds like a good idea, minus the fact it disables cd. I want the user(s) to be able to create directories in their home directory, and navigate through their own folders.

A chroot jail sounds like it comes with its own set of problems, and sounds like more of a headache than it's worth.

So, my question is, is there an easier way to limit a user to only being able to navigate their user directory, and not anything above their user directory?

share|improve this question
    
Why do you think chroot is a headache? With recent versions of OpenSSH it is borders on being trivially easy in my experience. Is there some specific issue that you believe you would have with it? –  Zoredache Aug 21 '12 at 20:00

2 Answers 2

up vote 4 down vote accepted

If you can limit them to just SFTP and not allowing them to login via ssh, then you can use the chroot facilities built into openssh. here is a good article explaining how

share|improve this answer
    
Thanks, I'll take a look at that! –  nojak Aug 21 '12 at 20:07

So, following the link and instructions Stew pointed me to, I was able to get this working. I had to make a few changes, though, to get SSH keys to work properly, though, so I thought I'd post a detailed list of what I did, for others to read.

To chroot a User Using SSH for SFTP Only Access:

As of Debian Squeeze 6.0.5 and OpenSSH 5.5p1

  1. Add a user: adduser username

  2. Add a group to assign users to that's for users you want to chroot:

    addgroup sftponly <-- group name doesn't really matter, as long as you change it in all the places below

  3. Add user to group: usermod -G groupname username

  4. Install libpam-chroot: apt-get install libpam-chroot

  5. Add the following line to /etc/pam.d/login

    session required pam_chroot.so debug

  6. Go to: /usr/share/doc/libpam-chroot/examples

  7. Then: chmod 744 setup-chrootdir-shell.sh so you can run the script

  8. Run the script, specifying the directory after the script:

    ./setup-chrootdir-shell.sh /path/to/userdir

  9. Verify that the directory that the script just created exists, is owned by user and group root, and is set to 755 permissions.

  10. Change home directory for user: usermod -m -d /home/chrootdir/home username

  11. Disable user's shell: chsh -s /bin/false username

  12. Copy user's files to the new directory (.ssh folder, .profile, etc.)

  13. Edit the sshd config file: vi /etc/ssh/sshd_config

    # %h/.ssh/authorized_keys is the default

    AuthorizedKeysFile /home/%u/.ssh/authorized_keys

    # Subsystem for chroot jail

    # Default is Subsystem sftp /usr/lib/openssh/sftp-server

    Subsystem sftp internal-sftp

    # Chroot jail config

    Match group sftponly

    ChrootDirectory /home/chrootdir/home/%u

    X11Forwarding no

    AllowTcpForwarding no

    ForceCommand internal-sftp

    Match

  14. If you are using AllowUsers, add this user to it.

    AllowUsers username

  15. Edit /etc/passwd and change the user directory location for the user

    vi /etc/passwd

    e.g: username:x:1001:1002:/home/chrootdir/home:/bin/false

  16. restart ssh: /etc/init.d/ssh restart

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.