0

I'm using debian on my home server. My goal is to create a user with permissions to upload files just in his directory (/var/www/user). The user should be able to access his dir using SSH, but he shouldn't be able to see parent dirs. /var/www/user should be his root dir and he shouldn't be able to see /var/www. How I can restrict user permissions like that?

  • My goal is to create a user with permissions to upload files just in his directory are we talking about FTP or SCP ? – user2196728 Jan 1 '14 at 20:35
  • he's gonna upload via SSH (PSCP/PUTTY) – Deepsy Jan 1 '14 at 20:40
  • Debian ( see first sentence ) – Deepsy Jan 1 '14 at 21:03
2

You can put the following directive into /etc/ssh/sshd_config:

ChrootDirectory /var/www/%u

See man sshd_config.

Note that with this setting, the user won't be able to log into an interactive session, unless /var/www/user contains a complete shell environment (/bin/sh and so on). But they will be able to use ssh/scp/sftp to transfer files into and out of just that directory.

The above will apply to all users. To restrict it to just one user, add Match User user in sshd_config before ChrootDirectory.

  • Will this apply for all other users? I want to make this just for a single user – Deepsy Jan 1 '14 at 21:04
  • Yes this will apply to all users. To restrict to one user add Match User myuser in sshd_config and then add directive under like ChrootDirectory /var/www/myuser – user2196728 Jan 1 '14 at 21:16
  • Requires the directory to be owned by root, so it won't work with regular user homes. – Daniel Beck Jan 1 '14 at 21:42
0

Perhaps jailkit can come in handy. This is a tool to set up a chroot environment for a user, providing only very specific executables while limiting access to a certain directory and its subdirectories.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.