1

I have 5 sites all under /home/mainuser. I have created user in /home/user1, currently the sftp works and the user is jailed to his folder. However, I want it to have access to 2 sites in /home/mainuser and hide the other 3 sites from user1. So I tried to create a symbolic link. But it doesn't work. Can anyone help me solve this problem?

This is my current settings:

Subsystem sftp internal-sftp

Match group SFTP-users
     ChrootDirectory %h
     X11Forwarding no
     AllowTcpForwarding no
     ForceCommand internal-sftp

3 Answers 3

3

On Linux, you can use a bind mount

mkdir /home/user1/site1
mount --bind /home/mainuser/site1  /home/user1/site1

To remove:

umount /home/mainuser/site1
1

Not really a hard and fast solution, but what if you create a dummy home directory, in which you place hard links to the directories you want him to access?

Beware though! hard links to directories can be dangerous! When you rm -r one, you will first empty out the contents, and because the contents are not duplicated, you will have removed your data. Remove a hard linked directory with unlink.

(you can use 'stat' to check if a file/directory is a hard link, by the number of links).

3
  • Very interesting about the hard link, rm -r and unlink. Good point.
    – Weboide
    Jul 25, 2010 at 22:13
  • I tried placing a hard link but it says hard link not allowed for directories. How can I create a hard ink?
    – Tony
    Jul 26, 2010 at 4:04
  • Hmm, ln has a -d option, but the man page says that it probably won't work because of system permissions. This might not be the best solution.
    – Halfgaar
    Jul 26, 2010 at 7:50
0

You could jail the user in /home and then screen off the directories the user not's supposed to see with permissions and/or ACLs (if your filesystem alllows them).

Not really the safest solution, because you would have to recheck the permissions on new directories that are being created, but maybe that's not an issue.

2
  • How do I screen off the directories the user not supposed to see?
    – Tony
    Jul 27, 2010 at 6:22
  • setting permissions to 0700 (rwx------) and making sure that they're not owned by the user on the directories you want not to be seen. ACLS involve using setfacl, see man setfacl.
    – Jasper
    Jul 27, 2010 at 6:48

You must log in to answer this question.