I have a Centos 6.5 machine. I add users with useradd username.

These users cannot browse other users directory, but they can browse all the OS filesystem starting from / and see configuration, passwords, logs, mysql, web server etc.

I feel that there is something wrong with the way I setup users and/or the whole machine, but I don't understand what.

I just need to create an user restricted to ssh, browse, sftp, ftp etc. only in his own home directory.

But what I have now is:

  • ssh, sftp: all OS except files/directory owned by other users
  • ftp: only his home

It seems to me also that jailing sftp user is not the same as having ssh jailed and involves things like giving root ownership to his home directory, which I cannot.

  • 2
    If they're able to see the contents of /etc/shadow then the file's permissions are set up incorrectly. No user configuration should yield that result.
    – Bratchley
    Dec 3 '14 at 15:35
  • 1
    It is quite normal, that a user can read (but not write to) most of the system files. Otherwise the user could not call system-wide installed programs.
    – jofel
    Dec 3 '14 at 16:07
  • @Joel, no /etc/shadow is forbidden.
    – Glasnhost
    Dec 3 '14 at 16:13
  • @jofel yes, I see what you mean. Maybe the problem is that I'm trying to use the same user to do 2 different things: 1-just sftp 2-deploy over git and basic admin tasks, like cleaning files, running small scripts etc. If I jail sftp he cannot do anything and the other way around
    – Glasnhost
    Dec 3 '14 at 16:19
  • What do you mean by “user restricted to ssh, browse, sftp, ftp etc.”: what can the users do? Is this an account only to upload files, or should users also be able to run applications? By “browse”, do you mean web browsers? Are the users local or are they logging in over SSH? Dec 4 '14 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.