0

I need to create an user in linux using putty that can only access a specific folder. I created an user using useradd but the user can access all the folders in the main account.

1
  • You can drop the user in a chroot when they connect, see here for an example. Commented May 10, 2018 at 10:32

1 Answer 1

2

You need to setup ssh chroot jail.

See this instruction.

As @Romeo asked, I include essential parts from linked page here.

Create dir for user:

# mkdir -p /home/test

This directory must contain the necessary files and directories to support a user’s session, this requires at least a shell, commonly sh, and basic /dev nodes such as null, zero, stdin, stdout, stderr, and tty devices:

# ls -l /dev/{null,zero,stdin,stdout,stderr,random,tty}

Learn two numbers from listing - there are major and minor numbers. Create the /dev with mknod command (do not copy-paste commands below, it's only example, use correct numbers):

# mkdir -p /home/test/dev/      
# cd /home/test/dev/
# mknod -m 666 null c 1 3
# mknod -m 666 tty c 5 0
# mknod -m 666 zero c 1 5
# mknod -m 666 random c 1 8`

Set permissions:

# chown root:root /home/test
# chmod 0755 /home/test
# ls -ld /home/test

Create the bin directory and copy the /bin/bash files into it:

# mkdir -p /home/test/bin
# cp /bin/bash /home/test/bin/

Identify bash required shared libs, and copy them(do not copy-paste commands below, it's only example) into the lib dir:

# ldd /bin/bash
# mkdir -p /home/test/lib64
# cp -v /lib64/{libtinfo.so.5,libdl.so.2,libc.so.6,ld-linux-x86-64.so.2}  /home/test/lib64/

Create the SSH user with the useradd command and set a secure password for the user:

# useradd tecmint
# passwd tecmint

Create the chroot jail general configurations directory, /home/test/etc and copy the updated account files (/etc/passwd and /etc/group) into this dir:

# mkdir /home/test/etc
# cp -vf /etc/{passwd,group} /home/test/etc/

Open the sshd_config file and add the lines below in the file.

# vi /etc/ssh/sshd_config
    #define username to apply chroot jail to
    Match User tecmint
    #specify chroot jail
    ChrootDirectory /home/test

Save the file and exit, and restart the SSHD:

 # systemctl restart sshd

Test if the chroot jail setup is working as expected. Now the user can only execute bash and its builtin commands such as(pwd, history, echo etc).

 # ssh [email protected]

Create a home directory for the the SSH user:

# mkdir -p /home/test/home/tecmint
# chown -R tecmint:tecmint /home/test/home/tecmint
# chmod -R 0700 /home/test/home/tecmint

Install a few user commands such as ls, date, mkdir in the bin directory:

# cp /bin/ls /home/test/bin/
# cp /bin/date /home/test/bin/
# cp /bin/mkdir /home/test/bin/

Check the shared libraries for the commands above and move them into the chrooted jail libraries directory:

# ldd /bin/ls
# cp -v /lib64/{libselinux.so.1,libcap.so.2,libacl.so.1,libc.so.6,libpcre.so.1,libdl.so.2,ld-linux-x86-64.so.2,libattr.so.1,libpthread.so.0} /home/test/lib64/

This is the end. But if you need to allow sftp connections only, then add the line below in the /etc/ssh/sshd_config file:

#Enable sftp to chrooted jail 
ForceCommand internal-sftp

Save the file and exit. Then restart the SSHD services:

# systemctl restart sshd
1
  • Great job on the edit Commented May 12, 2018 at 1:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .