How to allow restriced SSH access to chroot jailed user

June 8, 2015 12.5k views
Server Optimization Configuration Management Linux Commands System Tools Security Ubuntu
saurabh
By:
saurabh

A user was created and added in a group. The group has been chroot jailed in /var/www directory by adding following statements in sshd_config file:

Match group group_name
          ChrootDirectory %h
          X11Forwarding no
          AllowTcpForwarding no
          ForceCommand internal-sftp

While with above statements, the user is restricted in his home directory i.e. /var/www (home directory was designated while creating the user), the user is not yet able to login to terminal through SSH.

Now, it is required to allow this user to login to terminal through SSH (PuTTY) and be able to change his password. It is also required to restrict this user to only be able to change his password and not able to use any other command.

So finally, the user will be able to login to SFTP (WinSCP) & use it to upload his files and able to login to terminal through SSH (PuTTY) & change his password.

Can someone please advice necessary steps how to allow SSH access/login simultaneously along with SFTP access?

PS: The setting is required for Ubuntu!

Log In to Comment
1 Answer
ryanpq MOD December 21, 2017

I am not sure if there is currently a good solution for this since a chrooted user would not have access to /etc/passwd /etc/shadow to be able to update passwords even if you add the passwd utility to their path. If the only need for ssh is for password changes, using ssh-keys would be a more secure option or you could set up something like webmin/usermin which can be restricted to allow users to perform password changes via a web interface.

Reply
Have another answer? Share your knowledge.

Related Questions