Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How might I create an SFTP login for an untrusted user in which he can only access the files in his own home directory and not run any commands?

The online tutorial OpenSSH SFTP chroot() with ChrootDirectory is almost exactly what I need, except I'd like for the user to see his home directory as /home/user, rather than simply /.

Any help would be much appreciated.

share|improve this question

3 Answers 3

scponly is a hack. The built-in sftp-server with chroot was meant to address this need properly.

Ben, why do you want them to see their home as /home/user? Doesn't that kind of defeat the purpose of a chroot? Is it just pwd output that you're looking for to reflect their location?

Or is it so they can use full paths in a script? I think you could symlink /home/user/home/user to /home/user for those purposes.

share|improve this answer
    
Both the pwd and so the paths are "right". –  Ben Alpert May 5 '09 at 4:48
1  
Well, you can't make everything else unreadable without chrooting I don't think. They'd at least have to be able to read / and /home. You could create /home/user/home/user, take away write access to everything above that level and automatically cd them to /home/user (within the chroot) when they log in. The inevitable trade off with chroot is that you have to reproduce the root file system within it to make certain things work. In this case, two dummy directories isn't that bad, although of course you'd have to manage that for every user. –  Jeremy Huiskamp May 7 '09 at 21:30

Take a look at SCPonly it may be just what you are looking for

share|improve this answer
    
I'd prefer if I don't have to set up a separate chrooted set of libraries, etc. Is that possible? –  Ben Alpert May 5 '09 at 4:31

You can use MySecureShell which is doing what you want. You can chroot your users in an environment in a very easy way.

The configuration is also easy for doing what you want (only 4 lines) : Home $HOME VirtualChroot yes

Then add /bin/MySecureShell on the required users and it's done :-)

Good luck :-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.