Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

How to add an ssh user who only has permissions to access specific folder?

useradd -d /var/www/xyz.com.tr/musteri  -s /bin/bash -g sshd musteri

I created a user called musteri. I set its home folder and group. So, I want to integrate musteri users into "/var/www/xyz.com.tr/musteri". I don't want it to access another folder.

share|improve this question
    
Do you want the user to have full shell access, or only file copying protocols like sftp and rsync? –  Gilles Jun 21 '11 at 9:10
    
If the latter, you might want to look into scponly as a shell, possibly operating in chroot mode to restrict his access to that directory and nowhere else. –  Shadur Jun 21 '11 at 10:12
1  
@Gilles - I want to access through sftp. But,I don't want it to access another folder. –  Cell-o Jun 21 '11 at 11:06
1  
@Cell-o: If you only need a few file transfer protocols and not shells, use chroot plus scponly or rssh (Google scponly chroot or rssh chroot should lead you to howtos). –  Gilles Jun 21 '11 at 11:47
    
How about using ACLs? –  fpmurphy1 Jun 21 '11 at 14:23

2 Answers 2

up vote 5 down vote accepted

It sounds like you want your müşteriler to have file transfer access to a folder without actually giving them shells. This is a good thing because as binfalse pointed out, giving people shells with limited access is tricky because shells need to access all kinds of things scattered on the system just to run.

In order to give SFTP access to a specific folder, you can do something like this.

  1. Add a new group to the system, say 'sftponly'.
  2. Add any users on your system that should have restricted rights to this group. You could also give them restricted shells like /bin/true, but it's not required.
  3. Change your ssh config file (Usually /etc/ssh/sshd_config) with these lines
    Subsystem sftp internal-sftp

    Match Group sftponly
        ChrootDirectory %h
        AllowTCPForwarding no
        X11Forwarding no
        ForceCommand internal-sftp

This would activate the sftp subsystem inside of SSH and force members of that system group to use only that system when logging in. It would also chroot them to their home directories. You could change that to be a sub-folder of their home-directores as well with something like ChrootDirectory %h/musteri_sftp so that they couldn't se the rest of their system files but would login directly to a special subfolder of their home folder.

Kolay gelsin.

share|improve this answer
    
Öncelikle teşekkürler. ;) As you mentioned,I set up SFTP.But,I have a problem regarding iptables.Here is my rule. -> A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT –  Cell-o Jun 21 '11 at 18:06
1  
Birşey değil. While FTP would use port 21, SFTP is an ftp like protocol that runs over the SSH channel, so it is going to use the SSH port which by default is 22. –  Caleb Jun 21 '11 at 18:18
    
Caleb- Thanks again. –  Cell-o Jun 22 '11 at 7:54

In my opinion this is very difficult, if not impossible. When the user connects via SSH he at least needs a shell, in your case the bash. To execute /bin/bash he needs permissions to access /bin. bash itself needs to read some stuff from /etc (e.g. /etc/bash.bashrc), so the user needs also access to /etc. Assuming the user doesn't only want to hang around in this directory, he might want to read a file, but to execute for example vim he needs also access to /usr/bin.
This is just a slight demonstration, there are some more dependencies, e.g. I don't really know what will happen if the user doesn't have access to /tmp..

You should think about your intention. Do you just want somebody to have read/write access to a part of your web service? Then you might set up something like FTP to export a specific directory to this user. So he is able to read/write this files without SSH access.
Another nice solution would be a repository. For example set up a GIT repo and let the user clone it. He can do his changes locally and send you a patch. You can decide whether to apply this patch or not, a rollback for buggy patches is also very easy.

share|improve this answer
    
rbash is designed to do exactly this. –  bahamat Jun 21 '11 at 19:47
    
This thing is called a restricted shell. But since Cell-o only wants to allow file transfers, it's not the right tool. –  Gilles Jun 21 '11 at 20:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.