Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up the SFTP with different users. I simply need to strict some users to be given stricted Folder Access.

  • General users to access the whole Main FTP Directory normally: /project/workarea/*
  • User X to be able to access only: /project/workarea/room-x/*
  • So the User X should not be able to access other FTP directories above.

The problem is about X User only. (Folder Restriction Issue)
How to configure it please?

share|improve this question
Should the general users only have access to the Main FTP Directory, or do they have access to other directories as well? Should user X have access to any other directories outside of the /project directory? – Paul Dec 27 '12 at 9:03
Hi Paul, as i stated clearly above, general users will access /project/workarea/* and only X user will access only /project/workarea/room-x/* (only room-x folder and below. Not above). (Please mind the asterisks * also.) Just only to consider the issue with X user. (No need to consider about general users and their permissions, whatever they have. You can ignore.) – 夏期劇場 Dec 28 '12 at 5:16

This is the process for constraining users to specific folders over sftp.

The first step is to use the internal sftp service within sshd, by editing /etc/ssh/sshd_config. Change it so it looks like this:

# Subsystem       sftp    /usr/lib/misc/sftp-server
Subsystem       sftp    internal-sftp

At the end, add the following, which will constrain users of the 'sftpusers' group to their home folder only:

 Match Group sftpusers
   ChrootDirectory %h
   ForceCommand internal-sftp
   AllowTcpForwarding no

%h represents their home directory.

Add user x to the sftpusers group:

 useradd -G sftpusers x

Now edit /etc/passwd for user x so that their home directory is the folder they are allowed to access and also change their shell to nologin to prevent shell access:

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .