Restrict SFTP user to multiple folders

Question

I am probably missing something really obvious but is it possible to specify a list of folders (not just the users home directory) that a user can access via SFTP?

e.g.

Admin -> Full root access  
WebDev1 -> Access to the primary vhost folder and sub directories  
SysAdmin1 -> Access to all folders, except the vhost folder  
Manager1 -> Access to vhost folder, and phpMyAdmin install folder  

I can make it work fine for the "Admin" and "WebDev1" users but not the other 2.

For the "Manager1" user I wish to allow access to (including sub directories):

/data/vhosts  
/usr/share/phpMyAdmin  

This is on a Centos 7 system using SSHD. I would appreciate any help regarding this as it's been puzzling me for quite a few hours now.

Answer 1

key words related to what you want to do are SFTP chroot jail

you need to modify your sshd_config, first uncomment the line to enable SFTP which will correspond to something like this:

Subsystem sftp /usr/lib64/ssh/sftp-server

At the bottom of sshd_config, you may have some of the following in a template that is commented out. You will want something specifically like this:

# jail only user dave to folder /dave_sftp/
Match User dave
   ChrootDirectory /dave_sftp
   AllowTCPForwarding no
   X11Forwarding no
   ForceCommand internal-sftp

# jail only user ron to folder /ron_sftp/
Match User ron
   ChrootDirectory /ron_sftp
   AllowTCPForwarding no
   X11Forwarding no
   ForceCommand internal-sftp

# jail users that are in group sftp1_group to the folder /sftp1_group/
Match Group sftp1_group
   ChrootDirectory /sftp1_group
   AllowTCPForwarding no
   X11Forwarding no
   ForceCommand internal-sftp

# jail users that are in group sftp2_group to the folder /sftp2_group/
Match Group sftp2_group
   ChrootDirectory /sftp2_group
   AllowTCPForwarding no
   X11Forwarding no
   ForceCommand internal-sftp

Jailing a specific user to a specific folder is rather straight forward. Per your question of specify a list of folders that various users can access, it's just some manual labor on your part making a separate group and matching it to a specific folder you want to use, and putting those user(s) into those relevant group(s) which match the folders you want to give them jailed sftp access to. For example, put user dave into both groups of sftp1_group and sftp2_group to allow that user access to multiple folders.

A very good example can also be found here: https://serverfault.com/questions/591781/creating-sftp-users-and-jailing-to-chroot-on-centos-user-authentication-error

be mindful of

All folders up to the chroot home must be owned and only writable by root user. The folders cannot be group writable - even if the group is root

here is another example: https://askubuntu.com/questions/261663/how-can-i-set-up-sftp-with-chrooted-groups