I would like to create a ci user on a device to allow for a pipeline to drop a file into a single directory only.

I have created a user using:

useradd -M -N -r -s /bin/false devops
chown -R devops /var/file-drop/

For authentication, I have the following line in my sshd_config

TrustedUserCAKeys /etc/ssh/my-org.root.pub
AuthorizedPrincipalsFile /etc/ssh/authorized_principals/%u

and have added a file called devops with content devops in the authorized_principals directory.

My question is: excluding any 0-day vulnerabilities and such, does the above setup actually achieve my goal of allowing a user with that principal only access to dropping a file in /var/file-drop? Or am I inadvertently opening up other attack surfaces by doing this?

1 Answer 1


You can use chroot to "lock" the user to a diretory

Match User devops
ChrootDirectory /var/file-drop/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .