Home / server / Questions / 1081807
Accepted
Nuno
Asked: 2021-10-27 14:30:08 +0800 CST

Restrict user's access to only one directory

  • 772

ServerA needs to have a directory of ServerB mounted in a location, with write permissions.

I've been using SSHFS for this. I find SSHFS being very stable (100% reliable), while NFS was not so stable, besides being really hard to configure, and by default exposing to public, etc...

With SSHFS, I had to create a local user on ServerB, and put its private key on ServerA, to setup the mounts.

However, if someone ever hacks into ServerA, the hacker will be able to access any directory/file that may have 'other' read permissions anywhere on ServerB, by logging into ServerB with that user and its private key.

Is there any way to prevent this, so that the ONLY directory that this user can access is the directory that needs to be mounted on ServerA?

security ssh fstab sshfs centos7

1 Answers

  1. Best Answer

    Configure ssh server to put the user and their files into a restrictive chroot. If using OpenSSH, probably with directives ChrootDirectory and ForceCommand internal-sftp

    NFS requires defining exported volumes, and is not a remote shell. In those respects it fits your file share scenario well. While NFS can be encrypted, usually it is not, so for security reasons is generally confined to a private network.

    Both will result is a bad performance experience if the network drops or the remote goes away unexpectedly.

    • 1