Restrict user to do SFTP on the www folder owned by www-data group

Question

I would like to create a new user with read/write privileges ONLY in the /var/www/ directory including all sub-directories. The /var/www/ is owned by a group called www-data.

Best way to do it I guess is with SFTP. I already have SSH access as root. Many other answers relating to restricting SFTP access are related to the /home/ directory and require to change ownership of directory to root and I don't know if it's a good idea to do that also on the www directory.

Answer 1

You can create a user, set its home directory to /var/www/ and add him to the www-data group. If you want the files he will create belongs to the www-data group, you'll have to add the "s" bit to the www directory's mod.

# useradd -m /var/www -g www-data
# chmod g+s /var/www

Or did I missunderstand the question? Maybe you want that this user can't read any other directory? In this case you can chroot him: http://how-to.linuxcareer.com/how-to-automatically-chroot-jail-selected-ssh-user-logins

If you want to use SFTP: https://bensmann.no/restrict-sftp-users-to-home-folder/

s bit: http://en.wikipedia.org/wiki/Chmod#Special_modes

http://en.wikipedia.org/wiki/Setuid

Answer 2

A better way to do this is to use the chroot feature of sshd and the sftp subsystem.

Given a DocumentRoot setting of /var/www-sites/example.com/html

Create a group, named something like "chrootwebusers"

root@hostname:~# addgroup chrootwebusers

Add a user and set their home directory and some other options -

useradd -g chrootwebusers -d /var/www-sites/example.com -s /bin/false theusername
mkdir -p /var/www-sites/example.com/html
chown theusername.www-data /var/www-sites/example.com
chmod -R 750 /var/www-sites/example.com
chmod g+s /var/www-sites/example.com
passwd theusername

This adds the user named theusername with group membership in your chrootwebusers group, with a home directory of /var/www-sites/example.com and read/write access to everything below it.

The chmod g+s /var/www-sites/example.com works with the www-data group being the owning group. The use of the setgid bit on a directory makes any new files/directories created inside of it to keep the same group ownership as the example.com directory. This means the user the webserver runs as will always be able to read the files all the way down (be aware of this!)

Next, edit the /etc/ssh/ssdh_config file. Fine the line that specifies the sftp subsystem and comment it out-

#Subsystem sftp /usr/lib/openssh/sftp-server

And add in a reference to the internal-to-sshd sftp subsystem

Subsystem sftp internal-sftp

Finally, at the bottom of the file add

Match Group chrootwebusers
    ChrootDirectory /var/www-sites
    ForceCommand internal-sftp -u 0027

So... how does this all work? The sshd internal-sftp subsystem waits for a login from someone who has membership in the chrootwebusers group. When that happens, it will chroot them so that what you see as /var/www-sites they see as / . They will be able to see the example.com directory, and change into it and read/write files both there and in the DocumentRoot of /var/www-sites/example.com/html - but they will see it all as /example.com/html. The -u 0027 option sets the umask so any new files/directories created will have 640/750 permissions, and the setgid trick we used previously will make the owning user be theusername and the owning group the www-data user (remember the bit about the webserver being able to read all the files)