How to create a user and limit the user to a directory?

guest · 04-15-2009, 10:29 PM

I've been looking for this feature for months and couldn't find a solution for this. Does anyone know how to create users and limit the user to a specified directory?

Thanks in advance!

gmendoza · 04-15-2009, 11:17 PM

Search for chroot(). A useful set of utilities that make it easier to configure would be Jailkit.

http://olivier.sessink.nl/jailkit/

Others may suggest debootstrap, etc.

guest · 04-16-2009, 01:08 AM

Jailkit is so difficult to use..

It requires some indepth reading.. and tons of jargons

Is there an easy way to just creating a jailed directory and create a user/password for it and allow ssh?

That's all I really need...

theYinYeti · 04-16-2009, 02:18 AM

It may be overkill, but still you could be interested in this article by IBM:
http://www.ibm.com/developerworks/li...xc-containers/

Yves.

camh · 04-17-2009, 02:32 AM

http://www.fuschlberger.net/programs...p-chroot-jail/

guest · 04-18-2009, 01:38 AM

Quote:

Originally Posted by camh

http://www.fuschlberger.net/programs...p-chroot-jail/

I couldn't get into ssh/sftp with the jailed user login. It kicks me out right away. It doesn't even tell me pw is wrong. How would I look into this problem?

Also I've set host.domain.com to a jailed user's html directory, but when I access in my browser, it gives this error: "You don't have permission to access / on this server."

Perhaps there's something I have to enable for the jailed user? httpd perhaps?

anomie · 04-21-2009, 06:23 PM

Quote:

Originally Posted by guest

Is there an easy way to just creating a jailed directory and create a user/password for it and allow ssh?

Actually, no. This is nontrivial to do properly. Moreover, it introduces risk, because in this scenario chroot generally runs with elevated privileges (and it has a history of vulnerabilities and attack methods).

That said, I think openssh portable has chroot patches written for it (search the 'net). Alternatively, I have been OK with putting shell users in a FreeBSD Jail for the scenario you're describing. This would likely be akin to Linux-VServer for you.

So, again, the short answer is that there is no easy way to do this properly (IMO).