exclude a single user from chroot

Question

I have a chroot setup on my CentOS server, (chroot with no shell access / strictly sftp). Just for reference, the folders are like so:

home/sftp_users/%u     (root:root 750)

home/sftp_users/%u/input (site_user:sftp_users 770)

home/sftp_users/%u/input/result (site_user:sftp_users 770)

In my sshd.conf file I have this:

Subsystem       sftp    internal-sftp

Match Group webrecom_sftpusers
    ChrootDirectory /home/sftp_users/%u
    AllowTCPForwarding no
    X11Forwarding no
    ForceCommand internal-sftp

This pretty much does what I want. If you notice above I did not make the user the owner of the folders within their home directory. The reason for that is I don't want them to be able to delete those directories or change the permissions on them. Otherwise, someone is likely to muck it up at some point. They still have access to -r -w -e because of their group. While this does mostly what I want, because of their ability to write into input they can delete the result directory. I can work around this in PHP by re-creating that one folder. PHP will look in these folders for files to pick up and run and then return reports on them.

The issue is that site_user belongs to it's own group site_user and in PHP I can only assign a folder to the groups a user belongs to. If I add site_user to sftp_users then it gets stuck in the CHROOT jail.

I suppose I can make the folders owned by site_user and in the site_user group and set the permissions to 0777, but:

• is there another way to prevent users from changing permissions / deleting these directories that I overlooked
• is there a way to add site_user to sftp_users but not stick it in the jail

Answer 1

Match can take multiple conditionals. Try:

Match Group webrecom_sftpusers, User !site_user