2

I am using RedHat Gnu/Linux I have a group of 10 users, and I'd like to restrict the access to all of them. Here are the rules I'd like to respect for them:

  1. For each user user_i, there is a folder named user_i. The user_i should have writing and reading permissions on his directory and all the files/directories in it.
  2. When the user_i connects to the machine, he should find himself in the user_i directory by default.
  3. He (user user_i) can't see the other directories or files and has no access to them. The user_i directory is his "root" directory.

I created the group, I created all users and assigned them to this one group, and I created all folders. But I don't know how to continue beyond this.

I looked online and on this website. Most results found talk about modifying /etc/ssh/sshd_config for users connecting with SSH, while mine also needs to connect via FTP and SFTP. And other guides talk about giving access to all users of a certain group to one shared folder, which isn't my case because I need a separate folder to every user.

Edit:

Thanks everyone for your interaction and the useful information and I apologize about the confusion. Here I'll clarify the specification:

  1. The user_i folders are new folders created in /transfers directory specifically for every user and named after its username. So the hierarchy looks similar to this:

    /  
    --transfers/ 
    ----user_i/ 
    ------received_data/
    ------archive_data/
    

    Every user_i will write and read data in the subfolders received_data and archive_data. He can't access any other directory, including the typical Linux directories and specifically the directories of other users (the other 9 user_i).

    By connecting to the server, he should get to user_i folder by default, and therefore only see the two subfolders received_data and archive_data.

  2. All user_i belong to a group created specifically for them.

9
  • 3
    When you create a new user, it should give them a home directory, therefore this is done for you. You then need to set permission on the directories, see man chmod. I see nothing in your spec that groups these users. May 4, 2017 at 16:35
  • Sounds almost like each user should have their own container, or chroot.
    – Kusalananda
    May 4, 2017 at 16:58
  • When you say "can't see the other directories or files and has no access to them", what do you mean by "other"? Do you just want the users isolated from each others' home directories, or do you want the users not to have access to /bin and /tmp ? May 4, 2017 at 17:41
  • @richard: Yeah, home directories are created by default. But the directories we're using here are different as you can see in my Edit above.
    – Sevigne
    May 5, 2017 at 8:35
  • @Kusalananda: I think so. My manager asks me to chroot the folders with chroot command, but he doesn't know more. I'm still looking online and trying to figure it out.
    – Sevigne
    May 5, 2017 at 8:35

1 Answer 1

2

You are most probably looking for the ChrootDirectory option for sshd_config.

For each user user_i, there is a folder named user_i. The user_i should have writing and reading permissions on his directory and all the files/directories in it.

This is not possible with chroot. The users can not have write access to the directory they are chroot-ed in, because it would be security vulnerability (CVE-2009-2904). Every user needs its own directory inside the chroot he can write in. The filesystem hierarchy can look like this:

directory -- owner:group permissions
/chroots/ -- root:root 700
  user_i/ -- root:root 700
    data/ -- user_i:chroot_users 700

The sshd_config can look like this:

Match Group chroot_users
  ChrootDirectory /chroots/%u/

This will separate the users. But note that these users do not have any programs to run in their separated directories! You can give them only SFTP access:

Subsystem       sftp    internal-sftp

or copy the required programs into every chroot, for example for simple bash:

cp --parents /bin/bash /chroots/user_i/
cp --parents `ldd /bin/bash | cut -d'>' -f2 | awk '{print $1}'` /chroots/user_i/
4
  • Thank you for your answer. If I understand this right, I only have to modify the sshd_config file and include the 3 lines and that's it? Am I going to need to chmod the permissions of folders? What permissions should I give in this case? My manager asks me to use the chroot command, is it really necessary?
    – Sevigne
    May 5, 2017 at 8:47
  • 1
    The permissions are in the answer. The sshd will use the chroot "command" for you if you specify ChrootDirectory option in sshd_config.
    – Jakuje
    May 5, 2017 at 9:42
  • Thanks for your reply. I modified the permissions without a problem. But when I modified the sshd_config file, the server became unreachable. All SSH, FTP and SFTP connections were blocked. Is this normal? Is there a method to do this with the basic chroot command without modifying the sshd_config file?
    – Sevigne
    May 5, 2017 at 15:18
  • No. It is not normal. Check for the errors produced by the sshd
    – Jakuje
    May 5, 2017 at 15:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .