2

I want to know how I can restrict user access using OpenSSH Server. Let's say I want

  • user 1 to only access /Media, /Documents, and his home folder,
  • User 2 should only access /Folder21, and his homefolder,
  • User 3 should only have access to /Documents, /Folder21 and his home folder,

How can I do such a thing?

I found how to do it with one folder, but that was for all users, I think? description here: https://bensmann.no/restrict-sftp-users-to-home-folder/

(copied from link I gave above:
Can I just do this:

$ usermod User1 -s /bin/false
$ usermod User2 -s /bin/false

And set the user’s home directory:

$ usermod User1 -d /folder
$ usermod User2 -d /folder

then make all the other folders subfolders of /folder, and restrict access to those folders accordingly to my wishes using the chmod command, or is there a better solution??

Addition and clarification: Adding it to their homedirectory is not an option, as it are shared folders, some users need access to the same content,while it is restricted to other users,

This is what I had in mind:

  • user 1
  • user 2
  • user 3
  • user 4

  • folder "Network documentation"

  • folder "application documentation"
  • folder "Downloads"
  • folder "Media"

  • User 1 needs full access to everything, but Read-only access to application documentation List item

  • User 2 needs full access to both documentation folders
  • User 3 only needs access to the "Media" folder
  • User 4 only needs access to the folder "Downloads" and "Application Documentation"

2 Answers 2

0

Could you not just put whatever folders you want each user to access in their home directory? If not, I believe that ssh uses the same file permissions as the file system on the computer. So you can just use the same file permissions modifiers you would use to give a user access to a folder outside their home directory, like this: https://superuser.com/questions/280994/give-write-permissions-to-multiple-users-on-a-folder-in-ubuntu

1
  • Assuming "access" is to be understood broadly, this solution would be nontrivial to implement and possibly undesirable. Users have read and even execute access in many places outside their home folder (and the ability to create new files in some areas outside it, such as /tmp). I think it's complicated to change this just with UNIX permissions, ACLs, and/or AppArmor, and would break many important aspects of an interactive SSH session. For example, they must be able to execute their shell but it's usually located outside their home folder. And they must have access to some nodes in /dev. Oct 2, 2014 at 20:45
0

You could do a simple permissions control system.

First off, you need a directory tree, so let's do this:

~ (Home Folder
|
|---> Their Files
|
|---> Symlink to /opt/public/

In /opt/public/, you have all of your folders. In this case,

  • Media
  • Documents
  • Folder51

As you only have three users (and three folders), you could create groups.

A simple way to do this is to create a group for each folder. For instance:

  • groupadd opt-public-media-access
  • groupadd opt-public-documents-access
  • groupadd opt-public-folder51-access

Now, add the users to the specific groups (in this case, user1 is going to the media group.)

usermod -a -G opt-public-media-access user1

Finally, run these commands on each folder to secure read/write perms to the specific group only:

chown -R root:opt-public-media-access /opt/public/Media
chmod 770 -R /opt/public/Media/

Add and remove groups/folders at will. A few things to note, though:

  • The command to remove groups is groupdel. You should delete the group when you delete the folder.
  • Other users on the system not in the proper group will not be able to get into those folders, regardless.
  • Give each user their own home folder. Do not place it into something like /opt/public.
  • Root can go wherever he wants. Make sure none of the users have sudo rights.
  • All commands in this post are meant to be run as root, unless otherwise specified.
3
  • Okay, this sounds very easy.. I will try it and see how far I get, Thanks for your answer
    – FrankB
    Oct 3, 2014 at 17:34
  • Would the following help in setting it up? Then add the following stanza at the end of the file(etc/ssh/sshd_config) (add such a stanza for each group that you want to chroot): Match Group users ChrootDirectory /home AllowTCPForwarding no X11Forwarding no ForceCommand internal-sftp
    – FrankB
    Oct 3, 2014 at 18:32
  • I don't think that it'll matter.
    – Kaz Wolfe
    Oct 3, 2014 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .