As a reference, I'm on Ubuntu 12.04.5
I feel like I've looked at a hundred of these and for some reason, none have worked. This is most likely due to a lack of understanding on my part about what exactly I'm doing. What I'm trying to do is set up a user, and only let that user have access to their directory and anything under their home directory. However, I do not want them to be able to access anything above this home directory (meaning they should not be allowed to change the directory by doing
cd .. while in
Here are the steps I've taken:
- Set up the user
- Added the user to a special group so that they and other users could edit some files, we can call this
Set up the files
usernameneeds to be able to run things like mysql, ls, vim, etc. by issuing the following commands:
[AS ROOT] mount --rbind /bin /home/username/sprg/bin mount --rbind /dev /home/username/sprg/dev mount --rbind /etc /home/username/sprg/etc mount --rbind /lib /home/username/sprg/lib mount --rbind /proc /home/username/sprg/proc mount --rbind /sbin /home/username/sprg/sbin mount --rbind /sys /home/username/sprg/sys mount --rbind /usr /home/username/sprg/usr
root currently owns everything under
sprg including the folder itself.
/etc/ssh/sshd_configand changed the line:
Subsystem sftp /usr/lib/openssh/sftp-serverto
Subsystem sftp internal-sftp. At the end of the file, I added the following:
Match user username ChrootDirectory /home/username AllowTCPForwarding no ForceCommand internal-sftp
Restarted ssh via
sudo service ssh restart.
Now, when I change my user to
su - username, I am still able to view files and folders outside of my
/home/username directory. Also note that
To wrap it up, all I'm looking to do is have the user log into a terminal via ssh, get directed to their home directory (which already happens), and then disallows them from ever accessing another directory UNLESS it is under
/home/username. In which case, they are free to do as they please under that directory.
Any help would be appreciated!