Is it possible to limit what folders a user can
sftp to when using public/private keys?
Say I have a server with
user1 and their home folder is
/home/user1. I already have it configured so
user1 can SSH to the server using public/private keys. Right now they can also
sftp to the server using the same public/private keys and this lets them see the same files/folders they could if they had SSHd.
I want to create a new set of public/private keys that would be used just for
sftp but I want to make it so this set of keys only lets them view files/folders in
I don't see a way to do this through
authorized_keys so I am wondering if there is another way to do it?
The reason I want to minimize risk when/if different devices are compromised. In other words, if one of my devices with a public/private key is compromised, the hacker will only be able to do what that one public/private key combination lets them.
- I have a server at home running Linux with OpenSSH server running on it
- I have a few desktops at home that use public/private keys to access the server
- I have a laptop that will run a SFTP based sync client to sync the laptop's
C:\Users\me\Documentswith the server's
For that last bullet, I want to secure it such that if my laptop is compromised th bad actor won't be able to use the public/private keys to gain access to other parts of my server.
My sync client will use automation so I can't use passwords. Using public/private keys will work great because any decent SFTP client can use SSH public/private keys. But, even if my sync client is only configured to access
/home/me/docs/laptop/, the key will on the laptop so if a bad actor gets access to the laptop they could use the key to ssh to the box and gain access to other folders.
I looked into chrooting but it seems to work based on the login ID and not the public/private key being used. I don't want to create new login IDs because the files/folders in
/home/me will all be owned by the account
me and I don't want to muck around with granting other accounts access to different folders like
/home/me/docs/laptop/. Plus with chroot the main folder has to be owned by root which won't work for my use-case.