I'm trying to give access to our test environment to a contractor but our server has sensitive data on it.

I've created a user (contractorsaccount), I've added the user to a new group called contractors and the existing www-data group. I've gone through the process of setting up the public key/pem files and they can login. But they can access nearly every part of the site.

I've added this to the /etc/ssh/sshd_config but this might be the completely wrong approach.

Subsystem sftp /usr/lib/openssh/sftp-server

Match User contractorsaccount
   # need this so they can login
   ChrootDirectory /home/contractorsaccount
   AllowTCPForwarding no
   X11Forwarding no
   ForceCommand internal-sftp


Match Group contractors
  # Force the connection to use SFTP and chroot to the required directory.
  ForceCommand internal-sftp
  ChrootDirectory /var/www/html/app/
  AllowTcpForwarding no
  X11Forwarding no

They can login but the directory for /var/www/html/app/ (that they can see by being in the www-data group) isn't visible. I can't change the owner of /var/www/html/app/ without breaking the site.

How can I restrict their access to just these 2?

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.