Only allow user SSH access to one directory

Question

I have a server running Centos 6.4 and I need to allow a freelancer access to one folder on the server to upload some code and do some testing - I have set their home directory in /etc/passwd to:

username:x:505:505::/home/virtual_server/directory/home_directory/:/bin/bash

When they try and SSH in they get:

Could not chdir to home directory /home/virtual_server/directory/home_directory/: Permission denied
-bash: /home/virtual_server/directory/home_directory//.bash_profile: Permission denied

If they try and login via FTP (VSFTP where I have enabled chroot) they get an error:

Response:   500 OOPS: cannot change directory:/home/virtual_server/directory/home_directory
Error:  Critical error: Could not connect to server

I found a similar question from a few years back for which the accepted answer was needing to change all directories above the home directory to have read and execute https://serverfault.com/a/435430/142823

Is there an alternative way of doing this without needing to change permissions on other directories or something a little less "permanent"?

Answer 1

If your system used openssh then this can help:

Change sftp-server to internal one that can do ls, cd and other commands

# /path/to/the/sshd_config
. . . . .
Subsystem       sftp    internal-sftp
. . . . .

Then add rules for the user:

. . . . .
Match User username
        X11Forwarding no
        AllowTcpForwarding no
        ChrootDirectory /home/virtual_server/directory/
. . . . .

Then change user's shell to the /bin/nologin. Keep in mind that /home/virtual_server/directory/ should be root-owned when /home/virtual_server/directory/home_directory/ should be owned by that user.

Now user can access the /home/virtual_server/directory/ via SFTP being chrooted. He can't do anything within that dir except cd into home_directory where he can up/download, delete and rename files.

If you need that user have an ability to launch some commands/scripts - then create another login and grant him all needed with sudo.