A better way to do this is to use the chroot feature of sshd and the sftp subsystem.
Given a DocumentRoot
setting of /var/www-sites/example.com/html
Create a group, named something like "chrootwebusers"
root@hostname:~# addgroup chrootwebusers
Add a user and set their home directory and some other options -
useradd -g chrootwebusers -d /var/www-sites/example.com -s /bin/false theusername
mkdir -p /var/www-sites/example.com/html
chown theusername.www-data /var/www-sites/example.com
chmod -R 750 /var/www-sites/example.com
chmod g+s /var/www-sites/example.com
passwd theusername
This adds the user named theusername
with group membership in your chrootwebusers
group, with a home directory of /var/www-sites/example.com and read/write access to everything below it.
The chmod g+s /var/www-sites/example.com
works with the www-data group being the owning group. The use of the setgid
bit on a directory makes any new files/directories created inside of it to keep the same group ownership as the example.com
directory. This means the user the webserver runs as will always be able to read the files all the way down (be aware of this!)
Next, edit the /etc/ssh/ssdh_config
file. Fine the line that specifies the sftp subsystem and comment it out-
#Subsystem sftp /usr/lib/openssh/sftp-server
And add in a reference to the internal-to-sshd sftp subsystem
Subsystem sftp internal-sftp
Finally, at the bottom of the file add
Match Group chrootwebusers
ChrootDirectory /var/www-sites
ForceCommand internal-sftp -u 0027
So... how does this all work? The sshd
internal-sftp subsystem waits for a login from someone who has membership in the chrootwebusers
group. When that happens, it will chroot them so that what you see as /var/www-sites
they see as /
. They will be able to see the example.com directory, and change into it and read/write files both there and in the DocumentRoot
of /var/www-sites/example.com/html
- but they will see it all as /example.com/html
. The -u 0027
option sets the umask so any new files/directories created will have 640/750 permissions, and the setgid
trick we used previously will make the owning user be theusername
and the owning group the www-data
user (remember the bit about the webserver being able to read all the files)