0

I want to create a user that have only access to the following directories and can't see nothing else

/home/vehicles/ #read only
/home/images/  #read only
/home/dump/ #read and write

I used this link https://unix.stackexchange.com/questions/15360/how-to-add-a-ssh-user-who-only-has-permissions-to-access-specific-folder

so that I create a user group called testserver

 Match Group testserver
        ChrootDirectory %h
        AllowTCPForwarding no
        X11Forwarding no
        ForceCommand internal-sftp

and the chmod of those folders like the following

chmod -R 755 /home/vehicles/
chmod -R 755 /home/images/
chmod -R 765 /home/dump/

Everything went good except that testuser is still able to access other folders, how I prevent this user from accessing other folder(i.e only access those three folders)

1
  • ChrootDirectory only works if the target directory is owned by root -- and unless the home directory of testuser is /home itself that'll just lock them into their home directory. Oct 30, 2011 at 13:06

2 Answers 2

2

Okay, first off, change that directory structure to:

/home/testserver/vehicles
/home/testserver/images
/home/testserver/dump

Then execute

chown root.root /home/testserver /home/testserver/vehicles /home/testserver/images
chmod 755 /home/testserver
chown testuser.testserver /home/testserver/dump
chmod 775 /home/testserver/dump 

Finally, alter the ChrootDirectory directive line in /etc/ssh/sshd_config to

ChrootDirectory /home/testserver

I also recommend that you do a great deal of reading and brushing up on linux system administration in general, as your question and the things you attempted to do so far indicate "cargo cult" administration -- copy/pasting advanced administration tricks without understanding what they do or how they do it in the hope that they'll do what you want. This can very easily lead to disasters that you'll have no idea how to fix.

6
  • Thanks a lot for your answer But it still can access other files, I there exist a way to block this user from accessing anything else except /home/testserver/??
    – alex CSD
    Oct 31, 2011 at 9:29
  • Is /home/testserver/ owned by root.root ? Oct 31, 2011 at 9:42
  • yes, but dump folder is owned by testuser
    – alex CSD
    Oct 31, 2011 at 10:10
  • If you set up the ChrootDirectory /home/testserver directive and that directory is owned by root then the internal-sftp force command should keep it properly rooted in /home/testserver and only able to access /dump/, /vehicles/ and /images/ Oct 31, 2011 at 10:13
  • yes when I logged in, it directs me to /home/testuser then I changed the directory to the parent folder cd /home and suddenly I am able to access any folder according to it's permission for example those folders drwx---r-x 5 root root 4096 Oct 25 08:00 lib_dataDownloader drwx---r-x 2 root root 4096 Oct 24 07:54 localX
    – alex CSD
    Oct 31, 2011 at 10:19
0

Remove testuser from the groups users and any other groups, as well as use grsecurity path to define your RBAC lists.

If you intend to login with testuser then it needs rights to /bin and others, like /proc.

2
  • Sorry could you please give me some extra details as I am new at Linux system
    – alex CSD
    Oct 30, 2011 at 11:07
  • btw when I execute the following command egrep -i "^testuser" /etc/passwd it's output testuser:x:1002:1003:Test User,,,:/home/testuser:/bin/bash
    – alex CSD
    Oct 30, 2011 at 11:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .