I have two users and one shared folder in my Ubuntu server:
writer, which has write access to
/var/shared. It's an application regularly making file changes in this folder from remote, with SSH key.
readeris used by multiple clients with SSH key, a key they can get without my permission, that's why I need to restrict commands available in this shell.
I need to restrict commands accessible for
reader user, so it can use only sftp and rsync protocols (no standard commands like
top, ..); Only directory
/var/shared must be readable, and must be a root path, e.g. no need to
cd into it, it's already
/ in sftp or rsync.
How to write a shell script so I can apply it with
usermod -s for user
reader that will give such behavior? I cannot find any samples. How to make
writer also remain "jailed" to
/var/share, so paths are same?
I have tried
ForceCommand internal-sftpand ChrootDirectory directives already. This requires
ChrootDirectoryto be owned by root and non-writable (755 or less), also does not support
I have tried rssh, but it simply don't work for directories outside home directory for logged in user. So I couldn't chroot users to same directory with different permissions...
I tried to use
command=".." ssh-rsa....in authorized_keys file, but didn't get how can I enable behavior which I need, I only check
rrsyncscript from rsync's docs. This method has no
chrootfeature I need.
Can I have a sample at least for such shells? Is this achievable with scripts?
Bash and C++(if needed) are welcome. Output of
linux-vdso.so.1 => (0x00007fff7e9d1000) libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f79dfd8b000) libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f79dfb87000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f79df7bd000) /lib64/ld-linux-x86-64.so.2 (0x000055bd0767c000)