How to create a new user that can login to SSH and execute a set of commands

Question

I'm trying to setup new users for a particular directory but I want them to be able to see just one directory (and subfolders).

For example:

I have a server that has the following directories:

apache-user www-data /var/sites/mercury.solar-domain.com
apache-user www-data /var/sites/venus.solar-domain.com
apache-user www-data /var/sites/earth.solar-domain.com
apache-user www-data /var/sites/mars.solar-domain.com
apache-user www-data /var/sites/jupiter.solar-domain.com
apache-user www-data /var/sites/saturn.solar-domain.com
apache-user www-data /var/sites/uranos.solar-domain.com
apache-user www-data /var/sites/neptune.solar-domain.com

I want to add a new user: jupiter that could:

• Login to the server through ssh
• Is able to run via ssh scp, php, mysql, rsync (e.g.: $ mysql -u jupiter -p)
• The only visible directory for the user is: /var/sites/jupiter.solar-domain.com
• When the user logs in (through ssh) he can not go to another directory of the system (/usr, /root, /var/log, etc...)

I have checkout chroot and restricted shell but I don't think that their are the proper tool for me (or maybe I don't know how to configure them).

With chroot the problem is that I cannot change the user:group of the directory, for example: apache-user www-data /var/sites/jupiter.solar-domain.com will have to stay the same, I can add jupiter to the www-data group but I can not change the user:group of the folder.

With restricted shell looks like the user will only able to use a restricted set of commands like scp, sftp, rsync, cvs and rdist, but I want them to be able to use mysql and php.

Thank you very much for your guidance on how to solve the problem.

Answer 1

Try your luck with ACL.

You could have your user's home on /var/sites/jupiter.solar-domain.com.

Then set ACL's to also give the right to apache-user and www-data to access those folders.

Here's what you need to do:

1. Set your filesystem to use ACLs
2. Create your user jupiter with the home directory /var/sites/jupiter.solar-domain.com
3. Restrict his environment (check this Redhat procedure) (Restricted shell is something you need, and you can add the commands mysql and php in the PATH). Beware that in SSH, you need to set the PATH in .bashrc as well.
4. Set your directory to have apache-user with the rights : setfacl -d -m u:apache-user:rw jupiter.solar-domain.com
5. Also set the rights for the group www-data.