I have 5 sites all under /home/mainuser. I have created user in /home/user1, currently the sftp works and the user is jailed to his folder. However, I want it to have access to 2 sites in /home/mainuser and hide the other 3 sites from user1. So I tried to create a symbolic link. But it doesn't work. Can anyone help me solve this problem?

This is my current settings:

Subsystem sftp internal-sftp

Match group SFTP-users
     ChrootDirectory %h
     X11Forwarding no
     AllowTcpForwarding no
     ForceCommand internal-sftp

On Linux, you can use a bind mount

mkdir /home/user1/site1
mount --bind /home/mainuser/site1  /home/user1/site1

To remove:

umount /home/mainuser/site1

Not really a hard and fast solution, but what if you create a dummy home directory, in which you place hard links to the directories you want him to access?

Beware though! hard links to directories can be dangerous! When you rm -r one, you will first empty out the contents, and because the contents are not duplicated, you will have removed your data. Remove a hard linked directory with unlink.

(you can use 'stat' to check if a file/directory is a hard link, by the number of links).

  • Very interesting about the hard link, rm -r and unlink. Good point. – Weboide Jul 25 '10 at 22:13
  • I tried placing a hard link but it says hard link not allowed for directories. How can I create a hard ink? – Tony Jul 26 '10 at 4:04
  • Hmm, ln has a -d option, but the man page says that it probably won't work because of system permissions. This might not be the best solution. – Halfgaar Jul 26 '10 at 7:50

You could jail the user in /home and then screen off the directories the user not's supposed to see with permissions and/or ACLs (if your filesystem alllows them).

Not really the safest solution, because you would have to recheck the permissions on new directories that are being created, but maybe that's not an issue.

  • How do I screen off the directories the user not supposed to see? – Tony Jul 27 '10 at 6:22
  • setting permissions to 0700 (rwx------) and making sure that they're not owned by the user on the directories you want not to be seen. ACLS involve using setfacl, see man setfacl. – Jasper Jul 27 '10 at 6:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy