1

Decided to re-phrase the question entirely in order to not have to make a new one.

I currently have an SFTP server set up using OpenSSH's SFTP functionality. All my users are chrooted, and everything works.

What I need most right now is for one user, which is not root (because this user can't have any real SSH powers!), to have access to all other users' chrooted dirs. This user's job is to fetch all uploaded documents every once in a while.

Directory structure as of now is:

/home |_ /home/user1 |_ /home/user2 |_ /home/user3

With ChrootDirectory set as /home/%u

User "adminuser" should have access to user1, user2 and user3's directories without having access to /home or at the very least not to anything but /home.

Bonus points for the one who can tell me how to let users write inside /home/%u without having to make a new directory inside that dir which they own themselves, and not root as is the case with /home/%u (openssh chroot prerequisite).

3 Answers 3

3
+50

Create a new home directory, such as /chroothome.

Have all users home directories live within that chroothome.

chroot adminuser to /chroothome.

For everything else, just use filesystem permissions.

As far as your "bonus question," it isn't possible using native functionality. The inability for the chroot user to write to the root directory is a security mechanism by design. Of course, you can always modify the source code.

Nevertheless, I suspect you could specify the user's home directory as /user1 and have the working directory at login be the one they could write to.

4
  • The thing is, if you have a structure like that the chroot functionality will complain or most likely even refuse to work because the /chroothome where the user dir's reside isn't root owned, right? May 17, 2010 at 7:22
  • Why wouldn't it be root owned?
    – Warner
    May 17, 2010 at 13:50
  • Cause if it is, adminuser won't be able to access it? May 18, 2010 at 13:35
  • It would be able to if the permissions were 711 or 755.
    – Warner
    May 18, 2010 at 14:06
0

In your /etc/ssh/sshd_config add these lines:

Subsystem sftp internal-sftp

Match group SFTP-users
     ChrootDirectory /home/%u
     X11Forwarding no
     AllowTcpForwarding no
     ForceCommand internal-sftp

Then change owner of the user home directory

# chown root.root /home/user
# usermod -d / user
# adduser user SFTP-users

Restart ssh server daemon

#/etc/init.d/sshd restart
6
  • This is exactly what I have right now, except for a different home dir for the user. Whether the home dir is / or /home/<user>, it does not change a thing and doesn't help me in my situation I'm afraid. May 4, 2010 at 13:41
  • @HannesFostie Make me understand. You've made those changes, restarted sshd and when you ssh with the specified user you are not chrooted? Which distribution are you using? May 4, 2010 at 14:22
  • Those are the settings I was already using before you made your post. I believe the chroot works, as I cannot actually see any directories outside of the chroot, but I am required to create a subdirectory inside the chroot for the user to upload files in. So the user can't upload files in what appears to be, to him anyway, the root. May 4, 2010 at 14:34
  • To make it more clear: consider the following directory: /home/foo/bar. The user foo can log in and will see /bar. He can write inside /bar but not in /. I want him to be able to write in /, and have the files that are currently residing in / (.bash_logout, .bashrc and .profile) either invisible or moved away May 4, 2010 at 14:36
  • Maybe you can try # chown root.SFTPusers /home/user # chmod g+w /home/user so the user, being part of the group, can have write access to the dir and the other users of the group cannot (being jailed on their home dir) Is that viable? May 4, 2010 at 15:40
0

1°) Sshd checks that home directory is owned by the user who logged in. 2°) if you use chroot, sshd checks that every directory parent to the home is owned by root ( http://www.tenshu.net/archives/2008/10/09/openssh-51-chrootdirectory-permissions-issue/ )

If you want to chroot a user and let him read chroot for other users, the home of this user has to be a parent directory of the chroot of these user. Because of that you will broke one the the two previous rules.

AFAIK, the only solution would be to patch sshd :-)

2
  • Would using symlinks solve this? Use /home/%u for the regular dirs, then create a symlink for each of them somewhere else, and chroot the admin user to that dir. What about writing in the root of the homedir? Is that possible at all? May 12, 2010 at 7:34
  • no... sshd will also check if /home/%u is a directory :-) Maybe you can test with something like using a $HOME like /home2/privilegied_user_name and mount --bind /home /home2/privilegied_user_name/other_homes but... not very nice ...
    – aligot
    May 12, 2010 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .