No I don't think you can do this. You can finagle it but it's a bit of a maintenance nightmare. In the file /etc/ssh/sshd_config
you can add sections which match on things, say a user's group or a user's name.
sshd_config
AllowGroups sftponly sftpadmin root
Match Group sftponly
ChrootDirectory %h
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding no
PasswordAuthentication yes
But this only allows you to control a user's entry point, their ChrootDirectory
. So you'd have to drop them into their appropriate chroot
.
You can play some additional games with the automounting of these directories as well.
Example
* / -fstype=cifs,ro,noperm,netbiosname=${HOST},file_mode=0444,dir_mode=0555,credentials=/etc/sftpuser_credentials.txt ://server/sftpdata/& \
/upload -fstype=cifs,rw,noperm,netbiosname=${HOST},file_mode=0666,dir_mode=0777,credentials=/etc/sftpuser_credentials.txt ://server/sftpdata/&/upload
So you could add mounts which would allow them read access for the ones that they get access to and non-read access on the ones that they do not get access to.
NOTE: The above will grant a user read access on everything, but only write access on their /upload
sub-directory in their chrooted directory.
I would probably think of an alternative way to achieve what you want, this could get ugly quick, and will be a pain to maintain.