1

I'm creating a webserver, and I will have many users ssh/sftp into it. All they need to do is within their home directory, for example, /home/user/.

Many people have told me to use chroot, but it seems like it's a little bit too much, plus I'm going to have multiple users log in into the server so it'll be just a huge load on the server.

So to recap, I want to prevent users from leaving their home directory, /home/user/. Is this possible?

Improve this question
2
  • It is with chroot..
    – Tim Brigham
    Jan 18, 2012 at 22:30
  • Would you recommend chroot with multiple users on the server?
    – samwell
    Jan 18, 2012 at 22:31

2 Answers 2

Reset to default
4

Why would chroot be a "huge load on the server"? This is precisely what chroot was designed to do. There are guides aplenty on the internets that you can follow to get things set up.

Improve this answer
4
  • I read that it can slow down the server and take more memory. Would you recommend it with multiple users ssh/sftp into the server?
    – samwell
    Jan 19, 2012 at 4:31
  • It's likely that things will be just fine. Just give it a try. If it doesn't end up working, nothing has been lost.
    – EEAA
    Jan 19, 2012 at 4:36
  • its not a CPU load, but it requires each user to essentially have their own os install in their home directory. Otherwise an ssh user chrooted to their $HOME directory is pretty much not able to do anything. (like they couldn't run ls or cat since those require access to /bin and /lib)
    – stew
    Jan 19, 2012 at 15:29
  • A chroot does not imply a full OS copy. It depends on what you want available to a user once in the chroot. Also, there is no performance penalty or overhead.
    – jlecour
    Apr 30, 2021 at 13:50
1

SSH has built in chroot features for sftp, with ssh its a bit trickier since the users get to start a fully shell, but its also possible. Check out this howto:
http://www.howtoforge.com/chrooted-ssh-sftp-tutorial-debian-lenny

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .