I have a Debian server, and I want to give several users read only access to a subtree of folders on that server. Is there a way to do this without manually changing the rights of all files and folders?

3 Answers 3


If you really want to restrict them down as much as possible, I suggest looking at a chrooted ssh install. That way even if they did manage to break out their tree they wont be able to trawl around the underlying system.

The Debian guys have a guide available on the subject.


rssh does exactly that. From pizzashack.org:

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that. For a list of platforms on which rssh is known to work, see the Platform Support Page.


the original (from openbsd) sshd can do a full chroot, quoting from sshd_config:


         Specifies a path to chroot(2) to after authentication.  This
         path, and all its components, must be root-owned directories that
         are not writable by any other user or group.  After the chroot,
         sshd(8) changes the working directory to the user's home directo-

         The path may contain the following tokens that are expanded at
         runtime once the connecting user has been authenticated: %% is
         replaced by a literal '%', %h is replaced by the home directory
         of the user being authenticated, and %u is replaced by the user-
         name of that user.

         The ChrootDirectory must contain the necessary files and directo-
         ries to support the user's session.  For an interactive session
         this requires at least a shell, typically sh(1), and basic /dev
         nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4),
         arandom(4) and tty(4) devices.  For file transfer sessions using
         ``sftp'', no additional configuration of the environment is nec-
         essary if the in-process sftp server is used, though sessions
         which use logging do require /dev/log inside the chroot directory
         (see sftp-server(8) for details).

         The default is not to chroot(2).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.