I was wondering if there is a way to restrict access in ssh. More specifically I was wondering if I can prevent a user from going anywhere outside their home directory and "roaming" around where they shouldn't.

I tested this as a test user and I couldn't execute or view anything but I could change directories and list them wherever I pleased as long as it wasn't root access specific.

I don't want them changing directory out of their home directory at all...

Any ideas?

Thanks,
ErocM

I think what you're looking for is called a chroot jail. Checkout the guide Markus1982 put together:

http://www.linuxquestions.org/questi...hreadid=140806

And this portion of unSpawn's Security References:
http://www.linuxquestions.org/questi...598#post222598

Hope that helps.

to restrict access, just use the /etc/hosts.allow and /etc/hosts.deny files.

simply place this in your hosts.deny file:

ALL:ALL

to keep out everyone.

then to allow only certain IP addresses to have access to a connection on your box, use the hosts.allow and add in entries like this:


ALL:127.0.0.1
ALL:192.168.0.
ALL:172.135.
ALL:65.


You should most likely have the 127.0.0.1 entry in there always. Just add in the IP addresses you trust. you can use the class A,B,C in the different examples like i did.

Now your box will check the hosts.allow for a matching rule first, then pass it to hosts.deny if there is nothing matching in the allow section. That means that the ALL:ALL entry will be checked AFTER your allowed IP addresses are checked.

I hope that will at least help you with the unwanted connections. As for the roaming around, i think capt caveman's ideas are good ideas.

You're trying to restrict login access to the machine. The OP is trying to restrict access to a user's home directory after they log in.

that was why i said:


I was giving some MORE ways to shut things out.