4

How might I create an SFTP login for an untrusted user in which he can only access the files in his own home directory and not run any commands?

The online tutorial OpenSSH SFTP chroot() with ChrootDirectory is almost exactly what I need, except I'd like for the user to see his home directory as /home/user, rather than simply /.

Any help would be much appreciated.

3

scponly is a hack. The built-in sftp-server with chroot was meant to address this need properly.

Ben, why do you want them to see their home as /home/user? Doesn't that kind of defeat the purpose of a chroot? Is it just pwd output that you're looking for to reflect their location?

Or is it so they can use full paths in a script? I think you could symlink /home/user/home/user to /home/user for those purposes.

  • Both the pwd and so the paths are "right". – Sophie Alpert May 5 '09 at 4:48
  • 1
    Well, you can't make everything else unreadable without chrooting I don't think. They'd at least have to be able to read / and /home. You could create /home/user/home/user, take away write access to everything above that level and automatically cd them to /home/user (within the chroot) when they log in. The inevitable trade off with chroot is that you have to reproduce the root file system within it to make certain things work. In this case, two dummy directories isn't that bad, although of course you'd have to manage that for every user. – Jeremy Huiskamp May 7 '09 at 21:30
0

Take a look at SCPonly it may be just what you are looking for

  • I'd prefer if I don't have to set up a separate chrooted set of libraries, etc. Is that possible? – Sophie Alpert May 5 '09 at 4:31
0

You can use MySecureShell which is doing what you want. You can chroot your users in an environment in a very easy way.

The configuration is also easy for doing what you want (only 4 lines) : Home $HOME VirtualChroot yes

Then add /bin/MySecureShell on the required users and it's done :-)

Good luck :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.