Home / server / Questions / 848563
In Process
Eray
Asked: 2017-05-06 14:14:15 +0800 CST

User can access to only one directory with scp

  • 772

I want to create a user for my Ubuntu server. I will use this user to copy some files from server to my local computer. So permissions should be really limited. This user can only reach to /some/path directory in the server and read files. Nothing more.

To achieve this, I've created a user:

sudo useradd scp_user -M -d /some/path
sudo groupadd scp_group
sudo usermod scp_user -g scp_group
sudo usermod scp_user -s /bin/false  # disable ssh login
sudo chown -R scp_user:scp_group /some/path

And in my ssh config file:

Match Group scp_group
    ChrootDirectory %h
    #ForceCommand scp 
    AllowTcpForwarding no

But getting an error:

scp scp_user@IP:/some/path/test.zip test.zip
scp_user@IP's password:
Could not chdir to home directory /some/path: No such file or directory
/bin/false: No such file or directory

Can you please tell me which step I'm missing?

ubuntu

1 Answers

  1. In your question there is various flaws, as already pointed out by others:

    • The ChrootDirectory jails your user in his home directory
    • In that directory, there is no /bin/false executable (nor /bin/scp that would be needed for the scp itself).

    You can either:

    • Copy scp binary and its required dynamically loaded libraries into the chroot (users home directory)
    • Change the users shell back to /bin/bash or /bin/sh
    • Copy bash or sh binary and its required dynamically loaded libraries into the chroot (users home directory)
    • (this is awful ...)

    Or just use sftp:

    • Specify Subsystem sftp internal-sftp (and possibly ForceCommand internal-sftp) in the sshd_config
    • Restart sshd server

    You might also encounter some problems with permissions (read the errors in the server log!).

    • 0