I have a Debian server, and I want to give several users read only access to a subtree of folders on that server. Is there a way to do this without manually changing the rights of all files and folders?
If you really want to restrict them down as much as possible, I suggest looking at a chrooted ssh install. That way even if they did manage to break out their tree they wont be able to trawl around the underlying system.
The Debian guys have a guide available on the subject.
the original (from openbsd) sshd can do a full chroot, quoting from sshd_config:
ChrootDirectory Specifies a path to chroot(2) to after authentication. This path, and all its components, must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directo- ry. The path may contain the following tokens that are expanded at runtime once the connecting user has been authenticated: %% is replaced by a literal '%', %h is replaced by the home directory of the user being authenticated, and %u is replaced by the user- name of that user. The ChrootDirectory must contain the necessary files and directo- ries to support the user's session. For an interactive session this requires at least a shell, typically sh(1), and basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4), arandom(4) and tty(4) devices. For file transfer sessions using ``sftp'', no additional configuration of the environment is nec- essary if the in-process sftp server is used, though sessions which use logging do require /dev/log inside the chroot directory (see sftp-server(8) for details). The default is not to chroot(2).
rssh does exactly that. From pizzashack.org:
rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that. For a list of platforms on which rssh is known to work, see the Platform Support Page.