Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I installed SSH, but I found if I use my original account to login to Ubuntu, it has too many permissions.

I want to constrain the user to only have permissions for specific folders in Ubuntu. How can I configure such a user?

share|improve this question

2 Answers 2

up vote 17 down vote accepted

This is simple. Just create a new user with it's home directory set to the one you need him to have access to (this command must be run under sudo or in root shell):

adduser --home /restricted/directory restricted_user

This will create an user restricted_user, the directory /restricted/directory and then permissions on the directory will be set so the user can write to it. It won't have an ability to write to any other directory by default.

If you have the directory already, you can run adduser command with a --no-create-home option appended and set permissions manually (also with root privileges), like:

chown restricted_user:restricted_user /restricted/directory
chmod 755 /restricted/directory

If you need to make even world-writable directories unaccessible for this user, there are two variants.

1) If you want to provide an interactive shell session to the user, then consider following this manual on creating a chroot jail (in your /restricted/directory).

After that add following to your sshd_config:

Match user restricted_user
  ChrootDirectory /restricted/directory

2) If you only need him to copy files between his endpoint of connection and your host, everything is much easier. Add these lines in end of your sshd_config:

Match user restricted_user
  ForceCommand internal-sftp
  ChrootDirectory /restricted/directory

Subsystem       sftp    internal-sftp

Then comment out the Subsystem sftp /usr/lib/openssh/sftp-server by placing a hash (#) sign in the start.

After restarting your SSH server (it does not kill interactive sessions on restart, so it is safe even if you misconfigured something; also, does not close your running session before you have checked that you are still able to log in), everything should work as intended.

share|improve this answer
    
I tried , but it seems that i can still cd .. and browse the upper directory. and when I use vi a.txt in the upper directory, it shows:press enter or command to continue, and i can not quit vi –  Foolish Jun 6 '10 at 13:11
    
Extended the answer to include chroot instructions. –  whitequark Jun 6 '10 at 13:52
    
thanks very much –  Foolish Jun 6 '10 at 22:47
1  
Can I use option #2 if the user should only have sshfs access? –  flickerfly Sep 30 '13 at 18:51
1  
Everything works fine, except that I have no write permission. How can I set a write permission for this restricted directory. If I use chmod 775, the user can't login anymore. –  My-Name-Is Dec 12 '13 at 23:29

Waking up again this thread.

Well, I'm not using above direction to add users, instead I use:

$ sudo useradd -d /var/www/api -G www-data demo

$ sudo passwd demo


$ sudo chown -R www-data:www-data /var/www/*/ 
$ sudo chmod -R go-rwx /var/www/www/*/
$ sudo chmod -R g+rw /var/www/*/
$ sudo chomd -R o+r /var/www/*/

With this I can give access a user only one Folder

everything goes really well.

I can upload what I want. BUT

With this restricted user I also can upload things to : /var/www

and also I can see everything via SFTP

Can I restrict this user to see and upload just what is in /var/www/api ??

Thaks

share|improve this answer
    
Ok, the was a bad idea to choose the folder inside web look because the newly created user must have access to www-root , so my attempts are exhausting.... Now I don't know where to approach.. can someone give a hand please. –  Locke Apr 13 at 21:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.