limit sftp access to specific folders when using a public/private key with openssh

Question

Is it possible to limit what folders a user can sftp to when using public/private keys?

Say I have a server with user1 and their home folder is /home/user1. I already have it configured so user1 can SSH to the server using public/private keys. Right now they can also sftp to the server using the same public/private keys and this lets them see the same files/folders they could if they had SSHd.

I want to create a new set of public/private keys that would be used just for sftp but I want to make it so this set of keys only lets them view files/folders in /home/user1/data/.

I don't see a way to do this through authorized_keys so I am wondering if there is another way to do it?

Update

The reason I want to minimize risk when/if different devices are compromised. In other words, if one of my devices with a public/private key is compromised, the hacker will only be able to do what that one public/private key combination lets them.

For example:

• I have a server at home running Linux with OpenSSH server running on it
• I have a few desktops at home that use public/private keys to access the server
• I have a laptop that will run a SFTP based sync client to sync the laptop's C:\Users\me\Documents with the server's /home/me/docs/laptop/

For that last bullet, I want to secure it such that if my laptop is compromised th bad actor won't be able to use the public/private keys to gain access to other parts of my server.

My sync client will use automation so I can't use passwords. Using public/private keys will work great because any decent SFTP client can use SSH public/private keys. But, even if my sync client is only configured to access /home/me/docs/laptop/, the key will on the laptop so if a bad actor gets access to the laptop they could use the key to ssh to the box and gain access to other folders.

I looked into chrooting but it seems to work based on the login ID and not the public/private key being used. I don't want to create new login IDs because the files/folders in /home/me will all be owned by the account me and I don't want to muck around with granting other accounts access to different folders like /home/me/docs/laptop/. Plus with chroot the main folder has to be owned by root which won't work for my use-case.

Answer 1

Clarification requested:

You state linux but not if things configuration file lock downs/SELinux user lockdowns are in play or what linux OS this is?

You mention the presence of several users ( presently or planned ) but only seem to imply 1 user on several hosts. Still not seeing how having a sftp chroot would not work here.