Chroot SFTP users who require access to multiple directories under same parent folder

Question

I have a RHEL 6 server with a /Documents directory, and it has child directories 1 2 3 4 5.... right under the /Documents directory. Is it possible to create an SFTP chroot jail that only gives a user access to 1,2,7,9 but not the other folders?

I am using NFSv3 with RHEL 6 and am therefore limited in ACL choices somewhat.

Answer 1

The simple solution is to put all of these users in the same chroot jail, and arrange for the directories to all have non-confidential names and permissions that ensure that users can only access directories that you'd otherwise put in their jail. It's enough to enforce the permission of toplevel directories, users can't access anything below a directory that they have no x permission for.

If this isn't good enough, or if you can't set up the appropriate groups or ACLs, you can set up bind mounts to make all of a user's permitted directories visible under a common directory.

mkdir /Jails/bob /Jails/bob/{1,2,7,9}
mount --bind /Documents/1 /Jails/bob/1
mount --bind /Documents/2 /Jails/bob/2
…

Answer 2

No I don't think you can do this. You can finagle it but it's a bit of a maintenance nightmare. In the file /etc/ssh/sshd_config you can add sections which match on things, say a user's group or a user's name.

sshd_config

AllowGroups sftponly sftpadmin root

Match   Group sftponly
    ChrootDirectory %h
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no
    PasswordAuthentication yes

But this only allows you to control a user's entry point, their ChrootDirectory. So you'd have to drop them into their appropriate chroot.

You can play some additional games with the automounting of these directories as well.

Example

*       /               -fstype=cifs,ro,noperm,netbiosname=${HOST},file_mode=0444,dir_mode=0555,credentials=/etc/sftpuser_credentials.txt       ://server/sftpdata/& \
        /upload         -fstype=cifs,rw,noperm,netbiosname=${HOST},file_mode=0666,dir_mode=0777,credentials=/etc/sftpuser_credentials.txt       ://server/sftpdata/&/upload

So you could add mounts which would allow them read access for the ones that they get access to and non-read access on the ones that they do not get access to.

NOTE: The above will grant a user read access on everything, but only write access on their /upload sub-directory in their chrooted directory.

I would probably think of an alternative way to achieve what you want, this could get ugly quick, and will be a pain to maintain.