How to setup a proper SFTP user in linux?

Question

I have a special user called ftp just for... ftp. Now, I log in via SFTP and everything is cool BUT:

1. I automatically log in to my home dir: /home/ftp which is not cool. If i change the default home dir, I'd have to move the SSH auth files as well to the new home (I'm thinking the new home as /var/www/site.com/public/files) which i do not want to make public the auth keys.

2. The ftp user can see all the files in the server! This is absolutely not cool. Should i CHMOD the rest of the files? But if i mess with permissions i think will mess up something.

Any tips about how to:

1. Automatically redirect to the public files dir upon login.
2. Avoid the ftp user to move around the server, peeking around were it should not be!

Answer 1

It sounds like you want is a chroot for sftp. Here are several questions that ask the same question. Keep in mind that chroot is not really meant to be a solution for security since in some cases the user can escape from a chroot. You should make sure your system is still secure if they manage to escape the chroot. Using a chroot is a fine solution if you are just wanting to make the system easier for your users to use.

• http://serverfault.com/questions/13021/securing-file-system-for-secure-sftp-server
• http://serverfault.com/questions/39997/how-can-i-chroot-ssh-connections
• http://serverfault.com/questions/41212/it-is-fair-to-jail-my-sftp-users-to-their-home-directory
• http://serverfault.com/questions/13756/how-to-secure-sftp-wihtout-re-compiling-openssh
• http://serverfault.com/questions/4492/set-up-a-chrooted-sftp-login-with-openssh