Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Linux shell to restrict sftp users to their home directories?

Tags:

linux

shell

sftp

I need to give SFTP access to a directory within my webroot on my server. I've set up ben_files as a user and have set his home directory to

/var/www/vhosts/mydomain.com/files

That's all fine if he connects with plain old FTP - he's restricted just to that directory, but to enable SFTP i had to add him to bin/bash shell, which suddenly opens up my entire server...

Is there a way of giving him SFTP access but without opening up all my directories? I'd really like him restricted to only his home ;)

Thanks!

like image 677
MrFidge Avatar asked Oct 06 '09 17:10

MrFidge


People also ask

How do I restrict FTP users to my home directory?

To prevent specific FTP users from accessing the storage system, you can add them to the /etc/ftpusers file. To restrict FTP users to a specific directory, you can set the ftpd. dir. restriction option to on; otherwise, to let FTP users access the entire storage system, you can set the ftpd.


2 Answers

OpenSSH≥4.8 supports a ChrootDirectory directive.

Add to /etc/sshd_config or /etc/ssh/sshd_config or whatever your setup's global sshd config file is:

 Match user ben_files         # The following two directives force ben_files to become chrooted         # and only have sftp available.  No other chroot setup is required.         ChrootDirectory /var/www/vhosts/mydomain.com/files         ForceCommand internal-sftp         # For additional paranoia, disallow all types of port forwardings.         AllowTcpForwarding no         GatewayPorts no         X11Forwarding no 
like image 57
ephemient Avatar answered Oct 12 '22 19:10

ephemient


You might try setting his shell to /bin/rbash

RESTRICTED SHELL If bash is started with the name rbash, or the -r option is supplied at invocation, the shell becomes restricted. A restricted shell is used to set up an environment more controlled than the standard shell. It behaves identically to bash with the exception that the following are disallowed or not performed:

   ·      changing directories with cd 

plus more...

Make sure you fully understand what is allowed and disallowed before you use this.

like image 43
Dennis Williamson Avatar answered Oct 12 '22 20:10

Dennis Williamson