Thread: Restrict SFTP access to specific directory

hi. i'll start off saying, need os x server. apple discussions forum unlikely kind of thing, , openssh same, i'm posting here.

i'm trying setup few user accounts restricted sftp access. i've read chrootdirectory option in sshd_config, trouble is, requires chosen directory owned root , non-writable others. way filesystem organized, that's not practical. directory i'd chroot (called cdrips) on hard drive not owned root. looks this:

code:

$ pwd  /volumes/raid1  $ ls  total 32  drwxrwxr-x    9 server        staff    374 may  5 14:21 ./  drwxrwxrwt@   6 root          admin    204 may  8 23:10 ../  drwxrwxr-x+ 424 radiosharing  staff  14416 may  8 16:21 cdrips/  ...

also, cdrips needs writable other users. i've read, seems chroot not right thing here, don't know else do. advice appreciated.
thanks.

in linux, can around mount --bind. osx, you'll need utility can read @ http://sizzo.org/wp/2008/12/mount-bind-on-osx

careful this. mount bind *not* link, if try , rm -rf on you'll removing original files. need umount first.

here complete procedure creating "radio" sftp user on linux example. "$" indicates prompt (type rest; not $ sign!). # indicates comment follows: don't have type bits. adjust macos see fit:

code:

$ sudo adduser radio # create user called "radio"

have following in /etc/ssh/sshd_config

code:

subsystem sftp internal-sftp    match group sftp           chrootdirectory %h           forcecommand internal-sftp           allowtcpforwarding no

then commands are:

code:

$ sudo adduser radio sftp # add radio sftp group $ sudo usermod -s /bin/false radio # don't allow them shell  $ sudo rm /home/radio/.bash* # don't need these files $ sudo rm /home/radio/.profile  $ sudo chown root:root /home/radio # made root chroot works $ sudo chmod 0755 /home/radio # make sure permissions correct  $ sudo mkdir /home/radio/cdrips # make cdrips dir them save $ sudo chown radio:radio /home/radio/cdrips # that's owned them

at point have normal chrooted sftp setup, "cdrips" dir can upload to.

now, bind our "cdrips" dir 1 want give access :

code:

$ sudo mount --bind /volumes/raid1/cdrips /home/radio/cdrips

so though /volumes/raid1 isn't owned root, chroot still work. dir names don't matter: have called /home/radio/cdrips if wanted. or indeed, @ all...

Forum The Ubuntu Forum Community Ubuntu Specialised Support Security Restrict SFTP access to specific directory

Ubuntu