Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Instead of using...


I want to use


How would I do this? It would be good if users can't access /home, /var and such. I only need this for data transfers.

share|improve this question
How about a symlink? ln -s /mnt/thing/usr/prj /prj – phunehehe Apr 2 '11 at 16:25
possible duplicate of Restricting an SCP/SFTP user to a directory – Gilles Apr 2 '11 at 16:44
Concur. Pretty much the same issue. – Shadur Apr 2 '11 at 17:19

Look into the scponly 'shell' and set up a chroot.

share|improve this answer

Create a user whose home directory is /prj.

Create a ~/.ssh/authorized_keys file for the user which contains the remote users public key, as well as some restriction on the commands and ssh options available, like:

ding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQA
hblahblahblahblahblahblahblahblahB user@site.com

Make it as restrictive as possible.

Then you'll need to create that wrapper for scp. Something as simple as the following will work, but you'll want to add more security conscious checks and tests before using it in production.

#!/usr/bin/env bash


This is just an example of what's possible. In this case, the full scp command is captured in the environment variable $SSH_ORIGINAL_COMMAND, but since you can't specify a command with arguments in the command= clause of the .authorized_keys file, you need the wrapper.

Users can probably still access sticky public directories, like /tmp, but they'll have no access to roam around /var, or /home.

and they may be able to pull files off your server, but you could wrap all this up with chroot, and secure the system quite a bit more, with minimal effort.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.