Question
Ubuntu 16-04 - New User, Jailed to nested folder in public_html, no shell
- Posted December 26, 2018
- StorageUbuntu 16.04
Hi all!
I am looking to create a new user, let’s call him:
bob
I’d like bob to have access to just one folder nested deep in a site’s directory structure. bob should only have access to the bob folder below:
/var/www/site.com/public_html/users/bob
bob shouldn’t have access to any other folders above his folder, and my user, not bob, should still have control of that layer above him. Bob also should only have sftp access, no SSH access.
I followed along with the guide below but either have not been able to get the account to connect or locked out my user account (not bob) in the process. I literally just switched from CentOS to Ubuntu yesterday for my personal sites (I have experience in my job working with Ubuntu, but I’m not the expert on the team, clearly.) Besides that, its a pretty normal LAMP stack.
Could anyone help me with some sample code? I am guessing I am going wrong on the sshd_config, but I have really only followed instructions as best as I could tell.
Thanks in advance!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Hey friend,
Great question! In my personal opinion, the desired outcome is unnecessarily complicated and can end up being a time sink for the average user, with no real benefit. A privileged user added to the group that owns the directory should be enough, because they shouldn’t be able to change things not owned by their user/group or the group that owns the files/directory. While it is often an expressed desire that they not even be able to see outside of the directory, almost no one actually puts that kind of protection in place in production as it just isn’t necessary to maintain a functionally secure server, even in a shared environment.
However, the guide that you linked should function in theory. What happens when you try to do it? Note that the user account needs to have permissions to access the directory that you’re setting their chroot to.
Jarland