0

I'm still a novice with Linux. I'm building an Ubuntu mail/web server that multiple users will use. I would like to restrict users to their home directory so they can login, change their password, or manage their files with a shell. I would also like to keep all of a users files inside their home directory including mail, web, etc.

All the articles I have seen (for example How to restrict ssh users to browse only /home/%u contents) mention that you must chown the users directory to be owned by root. Okay, this seems to be the consensus.

Why is this the case?

Follow Up

Since I want the users to have access to passwd and other system utilities, I think my original question doesn't make sense any more. It seems like the right thing to do is to focus on the permissions of any special folders, including restricting access to other /home* directories.

Ideally I would like a user to have access to the files they need to manage (mail, web, etc.) and minimize access elsewhere, and definitely prevent a user from browsing or seeing other users files.

  • Hmm, I hadn't thought about that. I'm trying to keep things simple, and you mention something that would be the opposite of that. Can any harm come from someone poking through /etc/ or wherever? What is the current philosophy behind hiding certain configuration details? – Brian Jun 15 at 14:34
  • Fair enough. I'll dig a bit more into securing home directories. The users will generally not be Linux (or PC) savvy, so I'm not too worried, but I know I shouldn't rely on that. – Brian Jun 15 at 14:44
  • Dumb question, why allow execute for group and other? Why not remove permissions for group and other completely? – Brian Jun 15 at 14:54
  • Are you trying to stop them looking at files out side of there own directory (e.g. system files that they could down load off the internet, and a few config files such as /etc/passwd containing user-names). Or are are you trying to stop them reading and writing other users files? (The 2nd option is easy) – ctrl-alt-delor Jun 15 at 15:03
  • Good idea, I'll do that. – Brian Jun 15 at 16:23
0

Using ChrootDirectory only makes sense with internal-sftp, which when used with ForceCommand means the users matched by that configuration will only be able to use the SFTP protocol to access that server through SSH.

This is incompatible with what you state about what you're trying to accomplish:

I would like to restrict users to their home directory so they can login, change their password, or manage their files with a shell.

To get a shell, you need full SSH and not SFTP only, so that's probably not what you want...


Regarding ChrootDirectory and ownership by root, that's not really about the home directory necessarily but about the top of the chroot environment. The issue you're having here is using the home directory as the top of the chroot, when that's not really how ChrootDirectory is meant to be used, not really how it makes most sense.

A better way would be to use a configuration to expose chrooted home directories through SFTP would be:

Subsystem sftp internal-sftp

Match User brian
    ChrootDirectory /chroot/%u
    ForceCommand internal-sftp

Then, for each user, such as user brian, create a /chroot/brian which is owned by root:root (this is important, as it's a restriction for ChrootDirectory to work properly.) Then, inside /chroot/brian, create a home directory for the user, /chroot/brian/home/brian. This home directory can be writable by user brian, which is probably what you'd want (home directory fully manageable by its owner.)

The way ChrootDirectory works, the SFTP server will change to a home directory inside the chroot, if it can find one. The user accessing the server through SFTP will be able to go up to directory .. and ../.., but those will be mostly empty so nothing interesting will be exposed there.

You can link the "real" home directory with the one inside the chroot by using a bind mount:

$ sudo mkdir -p /chroot/brian/home/brian
$ mount --bind /home/brian /chroot/brian/home/brian

You can configure this mount in /etc/fstab so it's mounted every time the server is rebooted. You'll need one such mount for each user you want to expose SFTP to, so this might become quite a maintenance burden.

In any case, it looks to me that SFTP is not necessarily what you want, so ChrootDirectory is probably not relevant for your setup.


If you want to expose shell, it's technically possible to set up a chroot for each user and have them SSH into a chroot. However:

  • The setup for this configuration is quite complex. In particular, you need to fully populate a chroot, since in a shell you typically need a whole set of external commands (such as ls, cp, tar, etc.) to do something useful. If you set up chroots for every user, you'll need to populate them all with all these binaries, libraries they depend upon, etc. Furthermore, you'll need to update those binaries to fix bugs and security issues with them. It's a lot of work. And, perhaps more importantly:

  • A chroot is quite fragile and, if you have unrestricted access to it (which you typically do with a shell), there are often ways to break out from it. It's not trivial to close all loopholes in a chroot, so it's unclear there's a lot to gain in security from this setup.

Due to the increased complexity and the small (possibly inexistent) gains in security, I'd recommend against looking into a chroot setup for shell in SSH.


So, the question is what you're trying to accomplish, that's not already accomplished by the default setup shipped by a Linux distribution.

Typically, the Unix permissions are enough to implement a good level of security and isolation between users.

Users are already prevented from writing files to other users' home directories by default.

You can prevent users from browsing and reading files from other users' home directories by setting the permissions on the home directory to 0700.

(Restricting permissions of /home itself to 0711 would prevent listing home directories with ls /home, but there's not much to gain from that, since you can typically find a list of all users reading from /etc/passwd, which is required to be readable by all users in Linux.)

Users will be able to browse and read most of the rest of the filesystem (binaries, etc.) but that's typically expected, since they need most of those to use a shell.

The mail system should take care of setting proper ownership and permissions to prevent users from reading each other's e-mail, so typically that's already done correctly for you.

Do you have specific security concerns that are not already covered by the defaults? Otherwise, keep it simple and just use them, it should be more than enough for most typical use cases.

  • 1
    Thanks for the answer, that sort of sums up most of my options. I agree that chroot is almost certainly not the way to go. My main concern was to allow a user to fully manage their files and mail configuration, but with minimal effort on my part (a power user?). In my mail setup, I was hoping to store their mailbox and web data under their home directory so that everything is in one place. I still need to look at the impact of serving a web site from a home directory. I'm starting to get a better feel on what to search for now. – Brian Jun 15 at 17:28
  • It's fairly typical to allow users to host a web site inside their home directories, a typical convention is to use a public_html subdirectory right under the home directory and expose that as http://web.server/~user/ URL. Note that this means the home directory of user typically needs at least execute permissions (0711) since otherwise the webserver wouldn't be able to reach public_html under it, so there are constraints in how permissions of home directory need to be secured for that use case... Good luck, hopefully the pointers are useful! – filbranden Jun 15 at 17:32
  • 1
    Yes, quite helpful. Thanks. – Brian Jun 15 at 17:37
0

I would like to restrict users to their home directory so they can login, change their password, or manage their files with a shell. I would also like to keep all of a users files inside their home directory including mail, web, etc.

Ideally I would like a user to have access to the files they need to manage (mail, web, etc.) and minimize access elsewhere, and definitely prevent a user from browsing or seeing other users files.

You don't necessarily need a chroot environment for this. You can create users' accounts under /home in the normal way, and restrict access by one user to any other user's home directory.

chown root.root /home        # Guarantee owner/group
chmod o=x /home              # Search the directory but no read (listing) access
chmod go= /home/*            # Prevent anyone else have access to users' home directories

System databases such as /etc/passwd and /etc/group will be readable by all users, so there is some information leakage there about the set of users that have accounts on your system.

You may need to create and enforce disk usage quotas so that one user cannot fill the available disk space that should be shared amongst everyone. I'd recommend that /home be a separate partition to / so that filling /home will not bring the system itself to its knees.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.