3

I am working on making a new user with SSH access to my server for file sharing purposes via WinSCP. My goal was to restrict them to their home directory by having their default shell be rbash, but when I do this it won't let me connect to the server and it will stop at the "Connecting to Host..." message. I can connect with this user when the shell is set to the default shell. Is there a permission that I need to modify to get around this?

There is an entry in /etc/shells for rbash.

edit

Improve this question
1
  • @steeldriver I'm running Linux Mint 19.3 Cinnamon (Cinnamon version 4.4.8)
    – TheDankMeister
    Jun 2, 2020 at 2:54

3 Answers 3

Reset to default
1

Shell access typically requires shared system binaries and libraries. Limiting a user to only their home directory is unlikely to be usable (i.e. the user in question won't be able to do much).

If you want the user to run a certain program, you could set their login shell to that program. Git does this with git-shell for example.

In general on a multi-user system, it is a good idea to make home directories not world readable (such as by setting an appropriate umask, or adjusting home directory permissions).

Improve this answer
4
  • Oops, should have mentioned this in the post: I'm not trying to give the user a lot of capabilities, I would just like them to be able to read and write to their home directory for file sharing. Is there a way for me to use permissions to make the ssh files readable, home directory files readable/writable, and all others restricted?
    – TheDankMeister
    Jun 2, 2020 at 2:03
  • 1
    debian-administration.org/article/94/… + set all home directories and sensitive system files to not be world-readable.
    – D. SM
    Jun 2, 2020 at 2:52
  • I set the shell just like in the link, but setting the umask to 077 in the user's .profile file doesn't seem to take effect (there is no .bash_profile or .bash_login so it should be using .profile)? I feel like this is so close to what I am looking to do
    – TheDankMeister
    Jun 2, 2020 at 3:37
  • 1
    Bash reads different startup files in different situations. I personally don't use it for this reason among others. If you want to use bash you could put umask in all of the startup files or source some of the startup files from others. Also, individual programs may override umask.
    – D. SM
    Jun 2, 2020 at 6:28
0

I was able to restrict the user by adjusting my .sshd_config as shown here. This step prevents them from going back into the system files. In addition, I changed the permissions of the other /home/user/ folders with chmod -R 700 /home/user/, which stops them from going into other home directories, while still having full descent access within their own.

Improve this answer
0

You can create /sshchroot/user/user. /sshchroot/user would be owned by root and writable by root only (as ChrootDirectory demands) and you would bind-mount /home/user to /sshchroot/user/user. This way the user does not even see the other home directories.

mount --bind /home/user /sshchroot/user/user # can be done in /etc/fstab
Improve this answer
1
  • It is already in my shells file with: /bin/sh /bin/bash /bin/rbash /bin/dash
    – TheDankMeister
    Jun 2, 2020 at 1:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.