Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I freely admin that I am a server admin newbie, and I'd like to grant someone access to my server to help me on a project. Let's call this person 'joe'. I'd like joe to have access to only one directory via SSH with no root access. (If I can't lock him to a directory, I'm open to other ideas. Perhaps SFTP only)

I've stumbled through tutorials on adding the user and granting access in /etc/ssh/sshd_config, but I'm not sure if there are more safety precautions I should take. I'd hate to open a hole or lock things so tight that the user complains of constant permission issues.

Any suggestions on how to properly set up a user as described?

share|improve this question

closed as off topic by mdpc, Ward, Khaled, Dave M, Michael Hampton Feb 2 '13 at 22:42

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
did you think about chrooting him with containers (like lxc)? lxc howto –  Brigo Feb 2 '13 at 0:34
2  
What OS and version? –  Aaron Copley Feb 2 '13 at 1:19

1 Answer 1

You can use rssh or ChrootDirectory option from the new(ish) OpenSSH

$ man sshd_config
[...]
    ChrootDirectory
         Specifies the pathname of a directory to chroot(2) to after authentication.  All components of the pathname must be root-owned directories that are not
         writable by any other user or group.  After the chroot, sshd(8) changes the working directory to the user's home directory.

         The pathname may contain the following tokens that are expanded at runtime once the connecting user has been authenticated: %% is replaced by a literal
         '%', %h is replaced by the home directory of the user being authenticated, and %u is replaced by the username of that user.

         The ChrootDirectory must contain the necessary files and directories to support the user's session.  For an interactive session this requires at least
         a shell, typically sh(1), and basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4), arandom(4) and tty(4) devices.  For file
         transfer sessions using “sftp”, no additional configuration of the environment is necessary if the in-process sftp server is used, though sessions
         which use logging do require /dev/log inside the chroot directory (see sftp-server(8) for details).

         The default is not to chroot(2).

[...]

But unless you're paranoid (and you may have good reasons to be, I'm not judging), I'd just give the guy a regular shell account.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.