3

I have a VPS running Ubuntu 10.04, and I'd like to give someone SFTP access to a single directory, but prevent them from seeing anything else on the system. What's the best way to pull this off?

I considered removing "everyone" permissions from everything on the system, but that seems like a really blunt tool for this problem (and one that'll cause other issues) - I'm hoping there's a better option here.

Edit: I appreciate the answers! (And I learned a bunch reading/researching through them). I ended up finding and using this guide from Linode as it spelled all the steps: http://library.linode.com/security/sftp-jails/

2

Best way use ftps and chroot(vsftpd) or web-dav with ssl(Apache2,nginx).

Generate a Certificate :

openssl req -x509 -nodes -days 365 -newkey rsa:1024  -keyout /etc/vsftpd/vsftpd.pem   -out /etc/vsftpd/vsftpd.pem

Edit config:

 ssl_enable=YES
 rsa_cert_file=/etc/vsftpd/vsftpd.pem
 chroot_local_user=YES
  • That is FTPs not SFTP as OP asked. – Hrvoje Špoljar Feb 24 '11 at 17:42
  • @Hrvoje Easy and reliable install ftps. – ooshro Feb 24 '11 at 17:46
1

If you want SFTP which is subsystem of SSH check out this guide here

If you want FTP with SSL layer than ooshro suggestion is fine.

1

With Ubuntu you can use scponly fairly easily

sudo apt-get install scponly
sudo dpkg-reconfigure -plow scponly

Once it's installed and configured you can use the supplied script to create the user accounts and jails.

cd /usr/share/doc/scponly/setup_chroot
sudo gunzip setup_chroot.sh.gz
sudo chmod +x setup_chroot.sh
sudo ./setup_chroot.sh

Follow the onscreen prompts to configure the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.