Ubuntu 16-04 - New User, Jailed to nested folder in public_html, no shell

December 26, 2018 459 views
Storage Ubuntu 16.04
rmirre
By:
rmirre

Hi all!

I am looking to create a new user, let’s call him:

bob

I’d like bob to have access to just one folder nested deep in a site’s directory structure. bob should only have access to the bob folder below:

/var/www/site.com/public_html/users/bob

bob shouldn’t have access to any other folders above his folder, and my user, not bob, should still have control of that layer above him. Bob also should only have sftp access, no SSH access.

I followed along with the guide below but either have not been able to get the account to connect or locked out my user account (not bob) in the process. I literally just switched from CentOS to Ubuntu yesterday for my personal sites (I have experience in my job working with Ubuntu, but I’m not the expert on the team, clearly.) Besides that, its a pretty normal LAMP stack.

https://www.digitalocean.com/community/tutorials/how-to-enable-sftp-without-shell-access-on-ubuntu-16-04

Could anyone help me with some sample code? I am guessing I am going wrong on the sshd_config, but I have really only followed instructions as best as I could tell.

Thanks in advance!

Log In to Comment
1 Answer
jarland MOD December 27, 2018

Hey friend,

Great question! In my personal opinion, the desired outcome is unnecessarily complicated and can end up being a time sink for the average user, with no real benefit. A privileged user added to the group that owns the directory should be enough, because they shouldn’t be able to change things not owned by their user/group or the group that owns the files/directory. While it is often an expressed desire that they not even be able to see outside of the directory, almost no one actually puts that kind of protection in place in production as it just isn’t necessary to maintain a functionally secure server, even in a shared environment.

However, the guide that you linked should function in theory. What happens when you try to do it? Note that the user account needs to have permissions to access the directory that you’re setting their chroot to.

Jarland

Reply
Have another answer? Share your knowledge.

Related Questions