I'm trying to give access to our test environment to a contractor but our server has sensitive data on it.
I've created a user (contractorsaccount), I've added the user to a new group called contractors and the existing www-data group. I've gone through the process of setting up the public key/pem files and they can login. But they can access nearly every part of the site.
I've added this to the /etc/ssh/sshd_config but this might be the completely wrong approach.
Subsystem sftp /usr/lib/openssh/sftp-server Match User contractorsaccount # need this so they can login ChrootDirectory /home/contractorsaccount AllowTCPForwarding no X11Forwarding no ForceCommand internal-sftp Match Group contractors # Force the connection to use SFTP and chroot to the required directory. ForceCommand internal-sftp ChrootDirectory /var/www/html/app/ AllowTcpForwarding no X11Forwarding no
They can login but the directory for /var/www/html/app/ (that they can see by being in the www-data group) isn't visible. I can't change the owner of /var/www/html/app/ without breaking the site.
How can I restrict their access to just these 2?