43

I have ubuntu server on digitalocean and I want to give someone a folder for their domain on my server, my problem is, I don't want that user to see my folders or files or to be able to move out their folder.

How can I restrict this user in their folder and not allow to him to move out and see other files/directories ?

Improve this question
6
  • You might want to use separate user accounts for that purpose.
    – Martin von Wittich
    Commented Jun 11, 2015 at 11:00
  • Or maybe Jailkit
    – FloHimself
    Commented Jun 11, 2015 at 11:01
  • chmod is not good solution because i can't use it for all the folder in my server i used before he can move out his folder
    – badr aldeen
    Commented Jun 11, 2015 at 11:03
  • actually i have no idea about group because i didn't use it before can you just explain to me what the benefit of it ?
    – badr aldeen
    Commented Jun 11, 2015 at 11:11
  • Another method - serverfault.com/questions/497011/….
    – slm ♦
    Commented Jul 23, 2018 at 1:25

3 Answers 3

Reset to default
45

I solved my problem by this way:

Create a new group

$ sudo addgroup exchangefiles

Create the chroot directory

$ sudo mkdir /var/www/GroupFolder/
$ sudo chmod g+rx /var/www/GroupFolder/

Create the group-writable directory

$ sudo mkdir -p /var/www/GroupFolder/files/
$ sudo chmod g+rwx /var/www/GroupFolder/files/

Give them both to the new group

$ sudo chgrp -R exchangefiles /var/www/GroupFolder/

after that I went to /etc/ssh/sshd_config and added to the end of the file:

Match Group exchangefiles
  # Force the connection to use SFTP and chroot to the required directory.
  ForceCommand internal-sftp
  ChrootDirectory /var/www/GroupFolder/
  # Disable tunneling, authentication agent, TCP and X11 forwarding.
  PermitTunnel no
  AllowAgentForwarding no
  AllowTcpForwarding no
  X11Forwarding no

Now I'm going to add new user with obama name to my group:

$ sudo adduser --ingroup exchangefiles obama

Now everything is done, so we need to restart the ssh service:

$ sudo service ssh restart

notice: the user now can't do any thing out file directory I mean all his file must be in file Folder.

Improve this answer
4
  • 4
    I switched users as sudo su - obama and still it can see others' files @badr
    – alper
    Commented May 11, 2018 at 14:06
  • @alper This works on sftp tool. When user connect to server via sftp tool like filezilla, he can see his directory and can't go to other directories.
    – avantdev
    Commented Oct 14, 2020 at 1:23
  • 1
    This worked well for me, but I want to point out to follow the directions exactly. The ChrootDirectory needs to be the directory ABOVE whatever subdirectory you want the user to be able to, say, upload files to. I know this is in the answer, but it drove me crazy because I kept telling it to do /data/files/, instead of /data/ . How this helps sometimes.
    – Richard
    Commented Jan 27, 2021 at 19:30
  • @Richard That is exactly the thing I was wondering, if the parent root directory is really necessary. At first sight it seems redundant.
    – Philipp
    Commented Oct 24, 2021 at 12:49
14

Restrictions are a sensible issue, and it must be defined consistently. What you can do is to define a restricted shell for the user as his default shell.

For example, setting /bin/rksh (a restricted kornshell) instead of the user's predefined shell as the default shell for that user in /etc/profile.

NOTE: if the executable with this name is not existing on your system then create a hard link ln /bin/ksh /bin/rksh and ksh will determine by its name whether it's restricted or not.

The restricted shell will (for example) prevent doing a cd command, or specifying a command with a / (an explicit path) in the invocation, and it disallows changing the PATH, SHELL, or ENV variable, and output redirections are also prohibited.

You can still provide predefined shell scripts to the user that will (under the script implementors control!) allow the user to run that specific script(s) in an unrestricted environment.

Improve this answer
1
  • 1
    This answer is going to be much simpler than setting up a chroot environment so I've up-voted it.
    – Azhrei
    Commented Jun 11, 2015 at 22:06
7

The command chroot allows you to create a restricted root for a user, this question explains the concept of chroot and how to use it.

Update: Searching for chroot jail set up on digital ocean, brings up further documentation specific to their environment. Here's a couple which I think are related to what you might need.

How To Configure Chroot Environments for Testing on an Ubuntu 12.04 VPS

How to allow restriced SSH access to chroot jailed user

Here's one which relates to jailkit, which FloHimself suggested.

Improve this answer
2
  • yes they explain it but they didn't explain how to use it i tried with some commend but that what i get : chroot: failed to run command ‘/bin/bash’: No such file or directory
    – badr aldeen
    Commented Jun 11, 2015 at 11:35
  • 1
    True, but now you have heard of chroot jail, you could do more research, I've updated answer with some links to documents on Digital Ocean, which give further explanation tailored to their environment.
    – X Tian
    Commented Jun 11, 2015 at 11:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .