Hi All,

I run a server http, ssh, etc,

Now I have never needed to share my server, but recently a few friends of mine want to host some pictures from my server, no problem as i already run a website from home,

I created a user ie, james, I then created a symlink from his home directory to /var/www/html/james

great, tested it all out allworks, but the user has access to the whole server via ssh, how can I only allow him to use, his home dir, and the sym link i created in there to var/www/html/james


would love to know how to restrict him,



cheers all

Unfortunately, jailing users over ssh isn't nearly as simple as it ought to be.
There's lots of information on the subject, though -

http://wiki.linuxquestions.org/wiki/OpenSSH_chrooting

http://www.linuxquestions.org/questi...light=ssh+jail

http://www.debiansec.com/linux/papers/chrooting.html

and so on...

The reason it's all so tricky is that jailing a user to a certain directory tree involves 'chroot'ing' them - physically changing what their session views as the "root" of the system's directory structure. This means that done improperly, they can type "cd /" and they'll actually get to /var/www/html (or whatever you've got it set up to be). They won't be able to see any other parts of your directory structure... which include /bin/, /usr/bin, /dev, /home, etc - and without those, most commands won't work at all. Take a look at just what would be off-limits were they not allowed access to /bin, and you'll see what I mean.
So chroot'ing involves rerouting a lot of that stuff into whatever directory you want the user jailed into, so they can have a more or less usable system.

G'luck!

Something else to check is what he can actually DO with the rest of the server. Chances are good he can read everything, but that in and of itself isn't a problem. He most likely can't write most of the other places.Just make sure you lock him down if you give him sudo ability. Check out man sudo (if you are aven going to allow him sudo access), and restrict his ability to not do anything other than restart httpd and anything along those lines that he may need.

Peace,
JimBass