Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm running Minecraft on a server. How can I give my friend SSH access just to the minecraft folder (a root folder), the screen command, and some ports?

share|improve this question
add comment

3 Answers

To achieve first 2 points you have to jail user to a desired directory, it's term called sandboxing sometimes and it's related with chroot in linux.

A good article hove to chroot (jail) a ssh user can be found here.

About the third point I'm not sure, but you can look at How to Limit network access by user / group using iptables - Owner Match.

But I'm not sure if you have to give him such restrictions/privileges.

share|improve this answer
add comment

On FreeBSD, we can use jail to restrict user. But jail don't exist on Linux. (It may exist, but its not part of the system.) Jail on FreeBSD is Virtualization on the OS level. We can achieve the same thing on Linux. I suggest you to read that article, since it also mention some program that can do that. I recommend Virtualization on the OS level for more performance:

http://wiki.openvz.org/Introduction_to_virtualization

So basically, you run like a second OS, and your friend will be restricted to it, and its content. The second Os that will run will like run inside a folder, and your friend wont be able to exit it to see the rest of your file. He will be restricted only to it. This has more advantage over chroot, since it may be easy to escape a sandbox created by a chroot.

You will be able to access the minecraft folder without any problem. But you will have to also install screen on the second OS, if you want your friend to have access to screen, and install all other thing you want your friend to have access.

Normally, your second OS will have its specific IP, you just have to say that whenever something connect to your computer to port x and y, redirect it to that IP. So if he connect to your computer trough port (the port you want him to use to SSH) he is redirected in the second OS. Same with the minecraft port.

Also, to make it more easy to you, you could create a symlink to the minecraft folder, so you don't always to have to go to the second OS's folder to reach the minecraft folder.

It may be not the best solution for you (or it may be) but its still a viable solution that you should consider, as its not hard to set up, and offer the most security and privacy.

share|improve this answer
    
Linux has LXC (LinuX Containers) that do the same thing. It's somewhat new, but was already present in Ubuntu 12.04, and can be installed easily enough. –  ams Jul 8 '13 at 13:02
add comment

Limiting SSH access is pretty complicated without letting some kind of backdoor opened by mistake. It has not been conceived to achieve that.

I think the best solution is creating a VM which would have access to the minecraft folder and give your friend a SSH account on that VM.

For you, the best would be the use of operating system-level virtualization like lxc or OpenVZ, which basically implements chroot and other kernel level isolation mechanisms, with almost no performance impact.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.