In order to make a file server with restricted access, I set the following configuration:
On the file server (Debian Wheezy)
- Create a user
data-readerwithout home, without shell, in the group named
- Create a directory
/somewhere/share/owned by root with a sub-directory
/somewhere/share/data/accessible by the group
- Add the following configuration to
Match group data ChrootDirectory /somewhere/share ForcedCommand internal-sftp X11Forwarding no AllowTcpForwarding no
data-reader can only read files using SFTP in the directory
On the client (another Debian)
sftp data-reader@<server_ip> to connect to the server.
From the SFTP console I have access in read-only to
/somewhere/share/data with SFTP commands like
get and I cannot see other paths. Good ! that is what I wanted.
BUT there is this nice command listed with
! Escape to local shell
And if I run
I can actually see all the files from
/ on the server ! I can see the content of any file. But I don’t want that, I want the user not to be able to get out of his directory.
Is there a way to restrict access of this "escape" command ?
Thank you for your help.