I'm using debian on my home server. My goal is to create a user with permissions to upload files just in his directory (/var/www/user). The user should be able to access his dir using SSH, but he shouldn't be able to see parent dirs. /var/www/user should be his root dir and he shouldn't be able to see /var/www. How I can restrict user permissions like that?
2 Answers
You can put the following directive into /etc/ssh/sshd_config:
ChrootDirectory /var/www/%u
See man sshd_config.
Note that with this setting, the user won't be able to log into an interactive session, unless /var/www/user contains a complete shell environment (/bin/sh and so on). But they will be able to use ssh/scp/sftp to transfer files into and out of just that directory.
The above will apply to all users. To restrict it to just one user, add Match User user in sshd_config before ChrootDirectory.
answered Jan 1, 2014 at 20:43
-
Will this apply for all other users? I want to make this just for a single user– DeepsyJan 1, 2014 at 21:04
-
Yes this will apply to all users. To restrict to one user add
Match User myuserinsshd_configand then add directive under likeChrootDirectory /var/www/myuserJan 1, 2014 at 21:16 -
Requires the directory to be owned by
root, so it won't work with regular user homes.– Daniel Beck ♦Jan 1, 2014 at 21:42
Perhaps jailkit can come in handy. This is a tool to set up a chroot environment for a user, providing only very specific executables while limiting access to a certain directory and its subdirectories.
My goal is to create a user with permissions to upload files just in his directoryare we talking about FTP or SCP ?