84

I installed SSH, but I found if I use my original account to login to Ubuntu, it has too many permissions.

I want to constrain the user to only have permissions for specific folders in Ubuntu. How can I configure such a user?

4 Answers 4

87

This is simple. Just create a new user with its home directory set to the one you need him to have access to (this command must be run under sudo or in root shell):

adduser --home /restricted/directory restricted_user

This will create a user restricted_user, the directory /restricted/directory and then permissions on the directory will be set so the user can write to it. It won't have an ability to write to any other directory by default.

If you have the directory already, you can run adduser command with a --no-create-home option appended and set permissions manually (also with root privileges), like:

chown restricted_user:restricted_user /restricted/directory
chmod 755 /restricted/directory

If you need to make even world-writable directories unaccessible for this user, there are two variants.

1) If you want to provide an interactive shell session to the user, then consider following this manual on creating a chroot jail (in your /restricted/directory).

After that, add the following to your sshd_config:

Match user restricted_user
  ChrootDirectory /restricted/directory

2) If you only need him to copy files between his endpoint of connection and your host, everything is much easier. Add these lines at the end of your sshd_config:

Match user restricted_user
  ForceCommand internal-sftp
  ChrootDirectory /restricted/directory

Subsystem       sftp    internal-sftp

Then comment out the Subsystem sftp /usr/lib/openssh/sftp-server by placing a hash (#) sign at the start.

After restarting your SSH server (it does not kill interactive sessions on restart, so it is safe even if you misconfigured something; also, does not close your running session before you have checked that you are still able to log in), everything should work as intended.

8
  • 3
    I tried , but it seems that i can still cd .. and browse the upper directory. and when I use vi a.txt in the upper directory, it shows:press enter or command to continue, and i can not quit vi
    – Foolish
    Commented Jun 6, 2010 at 13:11
  • 1
    Can I use option #2 if the user should only have sshfs access?
    – flickerfly
    Commented Sep 30, 2013 at 18:51
  • 2
    Everything works fine, except that I have no write permission. How can I set a write permission for this restricted directory. If I use chmod 775, the user can't login anymore.
    – My-Name-Is
    Commented Dec 12, 2013 at 23:29
  • 5
    You should write the Subsystem sftp internal-sftp line in your second example above the Match block. Otherwise ssh will print out an error and does not start.
    – Tik0
    Commented Mar 13, 2015 at 10:53
  • 3
    Spoiler alert: does not work with scp
    – bicycle
    Commented Aug 7, 2017 at 19:22
19

The easiest way to create restricted user that cannot wander off the given directory (e.g., to the upper directory etc), and have a limited/picked set of command to use, is to use a Restricted Shell. Ref:

http://man.he.net/man1/rbash

First, create a symlink called rbash (run as root user).

ln -s /bin/bash /bin/rbash

Then just create a normal user with this Restricted Shell, and set it's home dir to the desired folder:

useradd -s /bin/rbash -d /home/restricted_folder username

Even without the Restricted Shell, if you explicitly do not add this user to sudoer's list, or any special groups, then it will be limited by default.

With the Restricted Shell, the following are disallowed or not performed:

  • changing directories with cd

  • setting or unsetting the values of SHELL, PATH, ENV, or BASH_ENV

  • specifying command names containing /

  • specifying a file name containing a / as an argument to the . builtin command

  • Specifying a filename containing a slash as an argument to the -p option to the hash builtin command

  • importing function definitions from the shell environment at startup

  • parsing the value of SHELLOPTS from the shell environment at startup

  • redirecting output using the >, >|, <>, >&, &>, and >> redirect- ion operators

  • using the exec builtin command to replace the shell with another command

  • adding or deleting builtin commands with the -f and -d options to the enable builtin command

  • Using the enable builtin command to enable disabled shell builtins

  • specifying the -p option to the command builtin command

  • turning off restricted mode with set +r or set +o restricted.

These restrictions are enforced after any startup files

Moreover/Optionally, to restrict the user to a limited/picked set of command to use, you can create a .bash_profile read-only to that user, with

PATH=$HOME/bin

and symlink whatever commands you allows into the ~/bin folder to that user:

ln -s /bin/ls /home/restricted_folder/bin/ls
ln -s /bin/mkdir /home/restricted_folder/bin/mkdir
ln -s /bin/rm /home/restricted_folder/bin/rm

etc.

HTH

1
  • 1
    i can find any file on the filesystem, including /root directory and i can read these files. Wondering how to further restrict access of seeing anything outside user folder or capturing any network packets or reading /var/log contents
    – 16851556
    Commented Aug 14, 2019 at 15:47
1

If you are looking just to hide the contents of folders from a user, eg the home folder names of other users, just set the permissions to 701. The owner can do anything, everyone else can only enter the folder, but can't list its contents or change anything unless they have sudo permissions.

I do this for clients. I make sure the top folder is root-owned, but with 701 permissions, and each subfolder is owned by who I want to be able to manipulate. I just then created a link in their home folder to the new restricted folder.

They can see the path if they "cd .." but have no idea what other files or folders are there.

1
  • Substantially faster to implement, and can be done with a single command "chmod 701 /my/folder" Commented Jul 27, 2022 at 19:23
0

I want to constrain the user to only have permissions for specific folders in Ubuntu.

This sounds like you want to select the folders this SSH user will have permission to. So, you would not necessarily want to include all world-readable directories on the server.

This is difficult to impossible to achieve with SSH users that you provide with some sort of interactive shell, so that they can execute commands. There were several attempts for this (rbash, scponly, rssh), all no longer considered secure enough and mostly abandoned.

So, instead of providing an interactive shell, you could provide your SSH user with a single command that allows managing files inside your specified directories, and nothing else.

There are several options, depending on which network file access protocol you want to use:

Option 1: SFTP via SSH

Using ForceCommand internal-sftp, as already explained in the answer by whitequark.

Option 2: rsync via SSH

rsync is a faster and more powerful network file access protocol, but not as end user friendly as SFTP. In other words, the GUI options for rsync are quite limited: free Linux options, free Windows option, commercial cross-platform option.

To set this up, follow the recipe below. It is a variant of the technique mentioned in the rsync(1) man page under "Using rsync daemon features via a remote-shell connection":

It is sometimes useful to use various features of an rsync daemon (such as named modules) without actually allowing any new socket connections into a system (other than what is already required to allow remote-shell access). Rsync supports connecting to a host using a remote shell and then spawning a single-use "daemon" server that expects to read its config file in the home dir of the remote user.

The difference is only, we don't spawn a single-use rsyncd server-side but use a permanently running rsync server there that is only available to localhost connections. For the variant that spawns a single-use rsyncd and all further details, please see this Gist (archive.org version as a backup).

The instructions below restrict SSH access to the command nc localhost 873, that is, forwarding the connection to the local rsyncd server. In contrast to any approach without rsyncd, access management can be done with the powerful features of rsyncd, while SSH transport security protects the otherwise unencrypted rsyncd connection.

  1. Configure /etc/rsyncd.conf to start rsync as a daemon, with access to files on the server that you want to expose, and with the daemon listening on the localhost interface only (use 127.0.0.1 rather than 0.0.0.0).

  2. In /etc/rsyncd.conf you will also have to reference a secrets file. The secrets file should contain a line with the required username and password as a username:password pair. Also do a chmod 600 for your secrets file, otherwise, rsync will refuse to use it. For example:

    chmod 600 /etc/rsync/rsyncd-backup.secrets
    
  3. Create a normal SSH user username on your server.

  4. Remove shell access from that new SSH user by adding a single SSH key with options to that user's .ssh/authorized_keys file:

    # /home/username/.ssh/authorized_keys
    command="/bin/nc localhost 873",no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-rsa SSH_KEY_HERE
    

    Explanation of the options:

    • command="/bin/nc localhost 873": force the command executed after login by that SSH user to be a netcat call to localhost port 873, basically forwarding the rsyncd connection via SSH.
    • no-port-forwarding: don't allow port forwarding.
    • no-agent-forwarding: don't allow agent forwarding
    • no-X11-forwarding: don't allow X11 forwarding

    If you want to offer password based login rather than keys, you can adapt the instructions to use ForceCommand rather than the key options field in ~/.ssh/authorized_keys.

  5. Connect from your local machine to the SSH server like this (using the so-called "rsync daemon notation" :: together with the --rsh=ssh option):

    rsync -av --rsh=ssh username@remote_host::remote_dir local_dir/
    
    
2
  • The "follow these instructions" link is dead.
    – Freddie
    Commented Jun 30, 2023 at 17:51
  • Fixed the broken link by taking over the content as good as I could from this incomplete archive.org backup. If it does not work as written, I added a link to a very similar recipe as well that has all the details.
    – tanius
    Commented Jul 3, 2023 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .