1

Is it possible to limit what folders a user can sftp to when using public/private keys?

Say I have a server with user1 and their home folder is /home/user1. I already have it configured so user1 can SSH to the server using public/private keys. Right now they can also sftp to the server using the same public/private keys and this lets them see the same files/folders they could if they had SSHd.

I want to create a new set of public/private keys that would be used just for sftp but I want to make it so this set of keys only lets them view files/folders in /home/user1/data/.

I don't see a way to do this through authorized_keys so I am wondering if there is another way to do it?

Update

The reason I want to minimize risk when/if different devices are compromised. In other words, if one of my devices with a public/private key is compromised, the hacker will only be able to do what that one public/private key combination lets them.

For example:

  • I have a server at home running Linux with OpenSSH server running on it
  • I have a few desktops at home that use public/private keys to access the server
  • I have a laptop that will run a SFTP based sync client to sync the laptop's C:\Users\me\Documents with the server's /home/me/docs/laptop/

For that last bullet, I want to secure it such that if my laptop is compromised th bad actor won't be able to use the public/private keys to gain access to other parts of my server.

My sync client will use automation so I can't use passwords. Using public/private keys will work great because any decent SFTP client can use SSH public/private keys. But, even if my sync client is only configured to access /home/me/docs/laptop/, the key will on the laptop so if a bad actor gets access to the laptop they could use the key to ssh to the box and gain access to other folders.

I looked into chrooting but it seems to work based on the login ID and not the public/private key being used. I don't want to create new login IDs because the files/folders in /home/me will all be owned by the account me and I don't want to muck around with granting other accounts access to different folders like /home/me/docs/laptop/. Plus with chroot the main folder has to be owned by root which won't work for my use-case.

Improve this question
4
  • can you assign groups to the user and folders?
    – JacobIRR
    Dec 21, 2018 at 21:43
  • no. this is user1's home folder so only user1 has access.
    – IMTheNachoMan
    Dec 21, 2018 at 21:45
  • I wasn’t using public/private keys, but I just got done dealing with this. Just look up using chroot with sFTP and there are dozens of well written articles. Or maybe specify why this doesn’t meet your needs.
    – Appleoddity
    Dec 22, 2018 at 5:32
  • @Appleoddity I looked into chroot but it won't work for my use-case. I updated the question with more details.
    – IMTheNachoMan
    Dec 22, 2018 at 6:13

1 Answer 1

Reset to default
0

Clarification requested:

You state linux but not if things configuration file lock downs/SELinux user lockdowns are in play or what linux OS this is?

You mention the presence of several users ( presently or planned ) but only seem to imply 1 user on several hosts. Still not seeing how having a sftp chroot would not work here.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.