5

I'm running Ubuntu 10.04. I have users' home directories set, but I want to restrict them to their home directory and its children when they are connecting via SFTP.

In other words: not allowing them to move outside out of it.

What do I have to do to achieve this?

Improve this question
6
  • Do you mean you don't want them to be able to run anything in /bin and /usr/bin? So no shell, gui or any traditionally user accessible commands?
    – Paul
    Dec 23, 2011 at 12:16
  • What do you want to achieve? E.g. restrict access to home directory in FTP or SFTP?
    – Daniel Beck ♦
    Dec 23, 2011 at 12:18
  • I meant in ftp. Edited accordingly
    – Janis Peisenieks
    Dec 23, 2011 at 12:21
  • -1 Question does not show any research effort.
    – Daniel Beck ♦
    Dec 23, 2011 at 12:26
  • 1
    Dangit, I meant sftp. Don't have ftp installed.
    – Janis Peisenieks
    Dec 23, 2011 at 12:47

1 Answer 1

Reset to default
9

FTP

From the Ubuntu documentation:

Securing FTP

There are options in /etc/vsftpd.conf to help make vsftpd more secure. For example users can be limited to their home directories by uncommenting:

chroot_local_user=YES

You can also limit a specific list of users to just their home directories:

chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list

After uncommenting the above options, create a /etc/vsftpd.chroot_list containing a list of users one per line. Then restart vsftpd:

sudo /etc/init.d/vsftpd restart

SFTP

Edit /etc/ssh/sshd_config:

Set subsystem sftp internal-sftp if necessary.

Add the following:

Match user theUserName
    ChrootDirectory %h
    ForceCommand internal-sftp

Save and test the configuration by running sshd -t. If this is successful, restart ssh afterwards to apply changes.

Depending on your exact setup, the folder you specify as ChrootDirectory (%h is the user's home) must be owned by root with no write permissions for others. So it's not exactly a real home directory.

Improve this answer
7
  • Thanks! I tried this, and what happens is - the user cant connect anymore. FileZilla say's Server unexpectedly closed network connection
    – Janis Peisenieks
    Dec 23, 2011 at 17:55
  • @JanisPeisenieks Cannot connect anymore using SSH, SCP or SFTP?
    – Daniel Beck ♦
    Dec 23, 2011 at 17:57
  • SFTP and SSH. Don't use SCP, so cant confirm
    – Janis Peisenieks
    Dec 23, 2011 at 18:08
  • 1
    @JanisPeisenieks SSH will no longer work, as the user has no access anymore to his login shell installed outside his chroot'ed home directory. You'd need to copy the required programs and libraries over to make them available. Try reading up on chroot, it really behaves in a similar way. Regarding the SFTP problem, check the log files if you haven't already done so. I suspect it's a permissions issue like I mentioned in the last paragraph of my post.
    – Daniel Beck ♦
    Dec 23, 2011 at 18:10
  • What I'm geting is bad ownership or modes for chroot directory component "/srv/www/"
    – Janis Peisenieks
    Dec 23, 2011 at 23:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.