Is it possible to limit what folders a user can sftp
to when using public/private keys?
Say I have a server with user1
and their home folder is /home/user1
. I already have it configured so user1
can SSH to the server using public/private keys. Right now they can also sftp
to the server using the same public/private keys and this lets them see the same files/folders they could if they had SSHd.
I want to create a new set of public/private keys that would be used just for sftp
but I want to make it so this set of keys only lets them view files/folders in /home/user1/data/
.
I don't see a way to do this through authorized_keys
so I am wondering if there is another way to do it?
Update
The reason I want to minimize risk when/if different devices are compromised. In other words, if one of my devices with a public/private key is compromised, the hacker will only be able to do what that one public/private key combination lets them.
For example:
- I have a server at home running Linux with OpenSSH server running on it
- I have a few desktops at home that use public/private keys to access the server
- I have a laptop that will run a SFTP based sync client to sync the laptop's
C:\Users\me\Documents
with the server's/home/me/docs/laptop/
For that last bullet, I want to secure it such that if my laptop is compromised th bad actor won't be able to use the public/private keys to gain access to other parts of my server.
My sync client will use automation so I can't use passwords. Using public/private keys will work great because any decent SFTP client can use SSH public/private keys. But, even if my sync client is only configured to access /home/me/docs/laptop/
, the key will on the laptop so if a bad actor gets access to the laptop they could use the key to ssh to the box and gain access to other folders.
I looked into chrooting but it seems to work based on the login ID and not the public/private key being used. I don't want to create new login IDs because the files/folders in /home/me
will all be owned by the account me
and I don't want to muck around with granting other accounts access to different folders like /home/me/docs/laptop/
. Plus with chroot the main folder has to be owned by root which won't work for my use-case.
user1
's home folder so onlyuser1
has access.