Is there a simple way to restrict an SCP/SFTP user to a directory? All methods that I've come across require me to set a chroot jail up by copying binaries, but I don't think that should be necessary.
SSH Supports chrooting an SFTP user natively. You just need to supply
In your sshd config file, and restart sshd.
If you are just doing sftp, then you don't have to do anything more. Unfortunately, this doesn't work for scp. For interactive shell, you will need to copy binaries, and /dev nodes into the chroot.
An example config, for just a single user, testuser:
A few things to be aware of, from the sshd_config man page:
All components of the pathname must be root-owned directories that are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.
Search for ChrootDirectory in man sshd_config for more information.
A chroot is a reasonably simple method. Since the operating system already has this security feature, daemon writers tend not to attempt to reimplement it.
Extra tip that isn't in the rssh documentation: If you need some files to be accessible in a chroot jail, you can use bindfs or Linux's
You might want to look at scponly; it's essentially a login shell that can only be used to launch scp or the sftpd subsystem. In the