Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Instead of using...

ssh://user@mysite.net:1234/mnt/thing/usr/prj

I want to use

ssh://user@mysite.net:1234/prj

How would I do this? It would be good if users can't access /home, /var and such. I only need this for data transfers.

share|improve this question
    
How about a symlink? ln -s /mnt/thing/usr/prj /prj –  phunehehe Apr 2 '11 at 16:25
1  
possible duplicate of Restricting an SCP/SFTP user to a directory –  Gilles Apr 2 '11 at 16:44
    
Concur. Pretty much the same issue. –  Shadur Apr 2 '11 at 17:19
add comment

2 Answers 2

Look into the scponly 'shell' and set up a chroot.

share|improve this answer
add comment

Create a user whose home directory is /prj.

Create a ~/.ssh/authorized_keys file for the user which contains the remote users public key, as well as some restriction on the commands and ssh options available, like:

command="/usr/bin/scp-wrapper",no-port-forwarding,no-X11-forwar
ding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQA
BAAABAQCblahblahblahblahblahblahblahblahblahblahblahblahblahbla
hblahblahblahblahblahblahblahblahblahblahblahblahblahblahblahbl
ahblahblahblahblahblahblahblahblahblahblahblahblahblahblahblahb
lahblahblahblahblahblahblahblahblahblahblahblahblahblahblahblah
blahblahblahblahblahblahblahblahblahblahblahblahblahblahblahbla
hblahblahblahblahblahblahblahblahB user@site.com

Make it as restrictive as possible.

Then you'll need to create that wrapper for scp. Something as simple as the following will work, but you'll want to add more security conscious checks and tests before using it in production.

#!/usr/bin/env bash

$SSH_ORIGINAL_COMMAND

This is just an example of what's possible. In this case, the full scp command is captured in the environment variable $SSH_ORIGINAL_COMMAND, but since you can't specify a command with arguments in the command= clause of the .authorized_keys file, you need the wrapper.

Users can probably still access sticky public directories, like /tmp, but they'll have no access to roam around /var, or /home.

and they may be able to pull files off your server, but you could wrap all this up with chroot, and secure the system quite a bit more, with minimal effort.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.