Related

Create a swap from the new storage Question Question
High Memory Droplets? No, create option for the poor lone devs Question Question

Question

Ubuntu 16-04 - New User, Jailed to nested folder in public_html, no shell

Posted December 26, 2018 758 views
Ubuntu 16.04Storage

Hi all!

I am looking to create a new user, let’s call him:

bob

I’d like bob to have access to just one folder nested deep in a site’s directory structure. bob should only have access to the bob folder below:

/var/www/site.com/public_html/users/bob

bob shouldn’t have access to any other folders above his folder, and my user, not bob, should still have control of that layer above him. Bob also should only have sftp access, no SSH access.

I followed along with the guide below but either have not been able to get the account to connect or locked out my user account (not bob) in the process. I literally just switched from CentOS to Ubuntu yesterday for my personal sites (I have experience in my job working with Ubuntu, but I’m not the expert on the team, clearly.) Besides that, its a pretty normal LAMP stack.

https://www.digitalocean.com/community/tutorials/how-to-enable-sftp-without-shell-access-on-ubuntu-16-04

Could anyone help me with some sample code? I am guessing I am going wrong on the sshd_config, but I have really only followed instructions as best as I could tell.

Thanks in advance!

Add a comment
rmirre
By:
rmirre
Add a comment

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
1 answer
jarland December 27, 2018

Hey friend,

Great question! In my personal opinion, the desired outcome is unnecessarily complicated and can end up being a time sink for the average user, with no real benefit. A privileged user added to the group that owns the directory should be enough, because they shouldn’t be able to change things not owned by their user/group or the group that owns the files/directory. While it is often an expressed desire that they not even be able to see outside of the directory, almost no one actually puts that kind of protection in place in production as it just isn’t necessary to maintain a functionally secure server, even in a shared environment.

However, the guide that you linked should function in theory. What happens when you try to do it? Note that the user account needs to have permissions to access the directory that you’re setting their chroot to.

Jarland

Reply Report
Submit an Answer

Related

Looking for something else?

Ask a new question Search for more help