28

I have ubuntu server on digitalocean and I want to give someone a folder for their domain on my server, my problem is, I don't want that user to see my folders or files or to be able to move out their folder.

How can I restrict this user in their folder and not allow to him to move out and see other files/directories ?

  • You might want to use separate user accounts for that purpose. – Martin von Wittich Jun 11 '15 at 11:00
  • Or maybe Jailkit – FloHimself Jun 11 '15 at 11:01
  • chmod is not good solution because i can't use it for all the folder in my server i used before he can move out his folder – badr Jun 11 '15 at 11:03
  • actually i have no idea about group because i didn't use it before can you just explain to me what the benefit of it ? – badr Jun 11 '15 at 11:11
  • Another method - serverfault.com/questions/497011/…. – slm Jul 23 '18 at 1:25
26

I solved my problem by this way:

Create a new group

$ sudo addgroup exchangefiles

Create the chroot directory

$ sudo mkdir /var/www/GroupFolder/
$ sudo chmod g+rx /var/www/GroupFolder/

Create the group-writable directory

$ sudo mkdir -p /var/www/GroupFolder/files/
$ sudo chmod g+rwx /var/www/GroupFolder/files/

Give them both to the new group

$ sudo chgrp -R exchangefiles /var/www/GroupFolder/

after that I went to /etc/ssh/sshd_config and added to the end of the file:

Match Group exchangefiles
  # Force the connection to use SFTP and chroot to the required directory.
  ForceCommand internal-sftp
  ChrootDirectory /var/www/GroupFolder/
  # Disable tunneling, authentication agent, TCP and X11 forwarding.
  PermitTunnel no
  AllowAgentForwarding no
  AllowTcpForwarding no
  X11Forwarding no

Now I'm going to add new user with obama name to my group:

$ sudo adduser --ingroup exchangefiles obama

Now everything is done, so we need to restart the ssh service:

$ sudo service ssh restart

notice: the user now can't do any thing out file directory I mean all his file must be in file Folder.

  • 1
    I switched users as sudo su - obama and still it can see others' files @badr – alper May 11 '18 at 14:06
11

Restrictions are a sensible issue, and it must be defined consistently. What you can do is to define a restricted shell for the user as his default shell.

For example, setting /bin/rksh (a restricted kornshell) instead of the user's predefined shell as the default shell for that user in /etc/profile.

NOTE: if the executable with this name is not existing on your system then create a hard link ln /bin/ksh /bin/rksh and ksh will determine by its name whether it's restricted or not.

The restricted shell will (for example) prevent doing a cd command, or specifying a command with a / (an explicit path) in the invocation, and it disallows changing the PATH, SHELL, or ENV variable, and output redirections are also prohibited.

You can still provide predefined shell scripts to the user that will (under the script implementors control!) allow the user to run that specific script(s) in an unrestricted environment.

  • This answer is going to be much simpler than setting up a chroot environment so I've up-voted it. – Azhrei Jun 11 '15 at 22:06
5

The command chroot allows you to create a restricted root for a user, this question explains the concept of chroot and how to use it.

Update: Searching for chroot jail set up on digital ocean, brings up further documentation specific to their environment. Here's a couple which I think are related to what you might need.

How To Configure Chroot Environments for Testing on an Ubuntu 12.04 VPS

How to allow restriced SSH access to chroot jailed user

Here's one which relates to jailkit, which FloHimself suggested.

  • yes they explain it but they didn't explain how to use it i tried with some commend but that what i get : chroot: failed to run command ‘/bin/bash’: No such file or directory – badr Jun 11 '15 at 11:35
  • 1
    True, but now you have heard of chroot jail, you could do more research, I've updated answer with some links to documents on Digital Ocean, which give further explanation tailored to their environment. – X Tian Jun 11 '15 at 11:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.