I have two users and one shared folder in my Ubuntu server:
writer, which has write access to
/var/shared. It's an application regularly making file changes in this folder from remote, with an SSH key.
readeris used by multiple clients with an SSH key, a key they can get without my permission, that's why I need to restrict commands available in this shell.
I need to restrict commands accessible for the
reader user so it can use only sftp and rsync protocols (no standard commands like
/var/shared must be readable, and must be a root path,
e.g., no need to
cd into it, it's already
/ in sftp or rsync.
How do I write a shell script so I can apply it with
usermod -s for user
reader that will give such behavior? I cannot find any samples. How do I make
writer also remain "jailed" to
/var/share, so paths are same?
I have tried
ChrootDirectorydirectives already. This requires the
ChrootDirectoryto be owned by root and non-writable (755 or less), and does not support
I have tried
rssh, but it simply doesn't work for directories outside the home directory for the logged in user. So I couldn't chroot users to the same directory with different permissions.
I tried to use
command=".." ssh-rsa....in the
authorized_keysfile, but didn't get how can I enable behavior which I need, I only check
rrsyncscript from rsync's docs. This method has no
chrootfeature I need.
Can I have a sample at least for such shells? Is this achievable with scripts?
Bash and C++ (if needed) are welcome. Output of
linux-vdso.so.1 => (0x00007fff7e9d1000) libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f79dfd8b000) libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f79dfb87000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f79df7bd000) /lib64/ld-linux-x86-64.so.2 (0x000055bd0767c000)