2 ms·
> Sadly the OpenSSH solution is over the top awkward when it comes to setting up chrooted access, but it works. With OpenSSH it's pretty easy to setup users in
by antoncohen 15y ago
> Sadly the OpenSSH solution is over the top awkward when it comes to setting up chrooted access, but it works.
With OpenSSH it's pretty easy to setup users in a chroot, with no shell access. The hard part is if you want logging (to audit what they do), then you need to create a log device in their chroot, which adds complication, and you need OpenSSH 5.2+.
sshd_config:
Subsystem sftp internal-sftp -l VERBOSE
Match Group sftponly
ChrootDirectory %h
ForceCommand internal-sftp -f AUTH -l VERBOSE
Make user1 only be able to use SFTP:
groupadd sftponly; usermod -a -G sftponly user1; usermod -s /sbin/nologin user1
If you actually want the "-l VERBOSE" logging to work you need to create ~user1/dev, then modify rsyslog.conf with:
$AddUnixListenSocket /path/to/user1/home/dev/log