Home / server / Questions / 240156
Accepted
dukevin
Asked: 2011-02-26 02:08:22 +0800 CST

Jail users in a directory

  • 772

tree

I have a vps running debian OS and would like to create user accounts on it.

I want it so that when the user logs in with sftp, everything in var appears to be their home directory and they cannot cd out of it.

For example, when user3 logs in, they have access to everything in var (read, write, execute) but cannot view (cd) user1 or user2's personal stuff.

How would I go about doing this?

I think I have to do this in chroot, but I have no idea how this would work.

Thanks

linux debian user-management users jail

3 Answers

  1. Best Answer

    The #1 problem that people encounter with chrooted SFTP is that OpenSSH, by default, requires that root owns the whole path to a given user's chroot directory. In other words, if you want to chroot someone into /home/someone, / must be owned by root and have permissions no wider than 0755, /home must be owned by root and have permissions no wider than 0755, and perhaps most surprisingly, /home/someone must be owned by root and have permissions no wider than 0755. In your case, you want to chroot people into /var (I'm not even going to ask), so you avoid this permissions problem, but in other cases where it's unavoidable, you may want to look into mount --bind.

    As to the actual chrooting, you've got two options for how to go about it: either by group or by user. In either case, you'll edit the sshd_config file. For group-wide, it'll look like:

    Match group sftponly
ForceCommand internal-sftp
ChrootDirectory /var
AllowTcpForwarding no

    For per-user configuration, it'll simply be:

    Match user sftpdude
ForceCommand internal-sftp
ChrootDirectory /var
AllowTcpForwarding no

    Note that internal-sftp wasn't supported until OpenSSH version 5 or so, so you may have to compile a custom copy of OpenSSH if you don't have access to a v5 package.

    • 1

  2. If you chmod 700 each user directory only the directory owner will be able to access the contents of that directory.

    i.e. chmod 700 /home/duke/aa/servers/user2 will prevent any user other than user2 (and root) from accessing it.

    Of course user2 needs to be the owner of /home/duke/aa/servers/user2 to access his own files.

    • 0

  3. Depending on the FTP server you use this should be relatively easy. Both proftpd and vsftpd, which as packages in Debian support chroot as an option. The ProFTPd docs are here.

    For SSH/SFTP look at http://www.debian-administration.org/articles/590

    • 0