2

I want to give a list of people SFTP access to /webdocs/ABC* where they will read-write access to only directories that match this wildcard. How do I do this? Can I create a chroot jaill or some other method via SFTP so that these users only see/access the wildcard match?

4

Within the sshd_config file which is what sets up the sftp facilities you can do the following:

AllowGroups sftponly

Match Group sftponly
    ChrootDirectory /webdocs/ABC
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no
    PasswordAuthentication yes

I do not believe it will do wildcards though. So you'll have to create separate instances of these rules within the file.

ChrootDirectory

excerpt from sshd config man page

$ man sshd_config
...
 ChrootDirectory
         Specifies the pathname of a directory to chroot(2) to after 
         authentication.  All components of the pathname must be root-owned 
         directories that are not writable by any other user or group.  
         After the chroot, sshd(8) changes the working directory to the 
         user's home directory.

         The pathname may contain the following tokens that are expanded at 
         runtime once the connecting user has been authenticated: %% is
         replaced by a literal '%', %h is replaced by the home directory of 
         the user being authenticated, and %u is replaced by the username
         of that user.

         The ChrootDirectory must contain the necessary files and 
         directories to support the user's session.  For an interactive 
         session this requires at least a shell, typically sh(1), and basic 
         /dev nodes such as null(4), zero(4), stdin(4), stdout(4), 
         stderr(4), arandom(4) and tty(4) devices.  For file transfer 
         sessions using “sftp”, no additional configuration of the 
         environment is necessary if the inprocess sftp server is used, 
         though sessions which use logging do require /dev/log inside the 
         chroot directory (see sftp-server(8)
         for details).
  • I cannot create a chroot jail for a user unless it is owned by root? How do I deal with allowing my web devs to upload via sftp to only the dirs that they need access to? I had these dirs as apache:apache ownership, so do I need to make it root:apache and add these users all to the apache group? – Gregg Leventhal Dec 20 '13 at 2:42
  • @GreggLeventhal - Yes the chroot jail needs to be owned by root. Take a look at this tutorial for full details. thegeekstuff.com/2012/03/chroot-sftp-setup. – slm Dec 20 '13 at 3:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.