In my opinion this is very difficult, if not impossible. When the user connects via SSH he at least needs a shell, in your case the bash
. To execute /bin/bash
he needs permissions to access /bin
. bash
itself needs to read some stuff from /etc
(e.g. /etc/bash.bashrc
), so the user needs also access to /etc
. Assuming the user doesn't only want to hang around in this directory, he might want to read a file, but to execute for example vim
he needs also access to /usr/bin
.
This is just a slight demonstration, there are some more dependencies, e.g. I don't really know what will happen if the user doesn't have access to /tmp
..
You should think about your intention. Do you just want somebody to have read/write access to a part of your web service? Then you might set up something like FTP to export a specific directory to this user. So he is able to read/write this files without SSH access.
Another nice solution would be a repository. For example set up a GIT repo and let the user clone it. He can do his changes locally and send you a patch. You can decide whether to apply this patch or not, a rollback for buggy patches is also very easy.
scponly
as a shell, possibly operating inchroot
mode to restrict his access to that directory and nowhere else.scponly chroot
orrssh chroot
should lead you to howtos).