Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm running Ubuntu 10.04. I have users' home directories set, but I want to restrict them to their home directory and its children when they are connecting via SFTP.

In other words: not allowing them to move outside out of it.

What do I have to do to achieve this?

share|improve this question
    
Do you mean you don't want them to be able to run anything in /bin and /usr/bin? So no shell, gui or any traditionally user accessible commands? –  Paul Dec 23 '11 at 12:16
    
What do you want to achieve? E.g. restrict access to home directory in FTP or SFTP? –  Daniel Beck Dec 23 '11 at 12:18
    
I meant in ftp. Edited accordingly –  Janis Peisenieks Dec 23 '11 at 12:21
    
    
Dangit, I meant sftp. Don't have ftp installed. –  Janis Peisenieks Dec 23 '11 at 12:47
show 1 more comment

1 Answer 1

up vote 4 down vote accepted

FTP

From the Ubuntu documentation:

Securing FTP

There are options in /etc/vsftpd.conf to help make vsftpd more secure. For example users can be limited to their home directories by uncommenting:

chroot_local_user=YES

You can also limit a specific list of users to just their home directories:

chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list

After uncommenting the above options, create a /etc/vsftpd.chroot_list containing a list of users one per line. Then restart vsftpd:

sudo /etc/init.d/vsftpd restart

SFTP

Edit /etc/ssh/sshd_config:

Set subsystem sftp internal-sftp if necessary.

Add the following:

Match user theUserName
    ChrootDirectory %h
    ForceCommand internal-sftp

Save and test the configuration by running sshd -t. If this is successful, restart ssh afterwards to apply changes.

Depending on your exact setup, the folder you specify as ChrootDirectory (%h is the user's home) must be owned by root with no write permissions for others. So it's not exactly a real home directory.

share|improve this answer
    
Thanks! I tried this, and what happens is - the user cant connect anymore. FileZilla say's Server unexpectedly closed network connection –  Janis Peisenieks Dec 23 '11 at 17:55
    
@JanisPeisenieks Cannot connect anymore using SSH, SCP or SFTP? –  Daniel Beck Dec 23 '11 at 17:57
    
SFTP and SSH. Don't use SCP, so cant confirm –  Janis Peisenieks Dec 23 '11 at 18:08
    
@JanisPeisenieks SSH will no longer work, as the user has no access anymore to his login shell installed outside his chroot'ed home directory. You'd need to copy the required programs and libraries over to make them available. Try reading up on chroot, it really behaves in a similar way. Regarding the SFTP problem, check the log files if you haven't already done so. I suspect it's a permissions issue like I mentioned in the last paragraph of my post. –  Daniel Beck Dec 23 '11 at 18:10
    
What I'm geting is bad ownership or modes for chroot directory component "/srv/www/" –  Janis Peisenieks Dec 23 '11 at 23:09
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.