I'm running Minecraft on a server. How can I give my friend SSH access just to the minecraft folder (a root folder), the
screen command, and some ports?
To achieve first 2 points you have to jail user to a desired directory, it's term called sandboxing sometimes and it's related with
chroot in linux.
A good article hove to chroot (jail) a ssh user can be found here.
About the third point I'm not sure, but you can look at How to Limit network access by user / group using iptables - Owner Match.
But I'm not sure if you have to give him such restrictions/privileges.
On FreeBSD, we can use jail to restrict user. But jail don't exist on Linux. (It may exist, but its not part of the system.) Jail on FreeBSD is Virtualization on the OS level. We can achieve the same thing on Linux. I suggest you to read that article, since it also mention some program that can do that. I recommend Virtualization on the OS level for more performance:
So basically, you run like a second OS, and your friend will be restricted to it, and its content. The second Os that will run will like run inside a folder, and your friend wont be able to exit it to see the rest of your file. He will be restricted only to it. This has more advantage over chroot, since it may be easy to escape a sandbox created by a chroot.
You will be able to access the minecraft folder without any problem. But you will have to also install screen on the second OS, if you want your friend to have access to screen, and install all other thing you want your friend to have access.
Normally, your second OS will have its specific IP, you just have to say that whenever something connect to your computer to port x and y, redirect it to that IP. So if he connect to your computer trough port (the port you want him to use to SSH) he is redirected in the second OS. Same with the minecraft port.
Also, to make it more easy to you, you could create a symlink to the minecraft folder, so you don't always to have to go to the second OS's folder to reach the minecraft folder.
It may be not the best solution for you (or it may be) but its still a viable solution that you should consider, as its not hard to set up, and offer the most security and privacy.
SSH has not been conceived to achieve that. You will likely find a solution that you think is secure, but in fact, there will probably be a backdoor somewhere (
ssh -o ProxyCommand, etc.).
I think the best solution is creating a VM which would have access to the minecraft folder and give your friend a SSH account on that VM.
For you, the best would be the use of operating system-level virtualization like lxc or OpenVZ, which basically implements improved
chroot and other kernel level isolation mechanisms, with almost no performance impact.