This question already has an answer here:

I would like to create a user that only has access to one folder and nothing else whatsoever.

I have already created a user but he has access to other parts of the system according to corresponding file settings. I don't want him to have that, I want him only to have access to one folder and nothing else. Everything else should preferably be just invisible to him.

Is it possible to create such a user,and if so, how do I go about doing that?

p.s. Removing 'other' privileges of other users home directory goes a bit of the way towards this end. But this limited user still has access to all the base directories like /etc and such. And he can still see other users home directory, even though he cant access them.

marked as duplicate by Gilles, slm, rahmu, jasonwryan, Anthon Aug 21 '13 at 5:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    what *nix are you in? how is the user going to access the system? – Matt Aug 20 '13 at 13:15
  • I'm using L-Ubuntu but intend to also use this for OSX. This limited user will access via ssh. – Hermann Ingjaldsson Aug 20 '13 at 13:21
  • What does he need ssh for? Is it to upload files, or to attempt to issue commands or some other purpose? – Drav Sloan Aug 20 '13 at 13:51
  • It's to run rsync via ssh on that one folder. – Hermann Ingjaldsson Aug 20 '13 at 13:53

Apparently, you can. I never tried it myself, but jailkit seems to fit the bill. It doesn't seem to have been pre-packaged for Debian, so your only option is to build from source if you're on Debian or any of its children.

Thanks to @terdon's comment, we know it's been packaged as RPM and as a source package for Arch.

@terdon's links:

From @slm's comment, a note on installing jailkit from source.


Since you indicate in your comments that you're planning to give this user access via SSH, these additional articles may be of value to you:


If rsync is your one and only use case, you may want to think about simply exposing an rsync server that the user can connect to directly.

A very detailed explanation for rsync + stunnel

This is how you would access that service

If you insist on SSH you could just disable login by setting that users shell to /bin/false, which would still allow you to use SSH as tunnel through which you could make your rsync connection work, as described here

Not the answer you're looking for? Browse other questions tagged or ask your own question.