Hi guys!

I have to do the following:

- create a new user on my linux box (red hat 8) that has a public IP

- this user must have access with full privileges (creation, editing, deletion of files and directories) ONLY AND ESCLUSIVELY to a directory that I decide (and that is not his home directory); he must NOT view other directories in any way

- moreover each time this user connect from his win machine to my linux machine using SSH (with user name and password) he can access ONLY AND ESCLUSIVELY the directory I assigned to him (I repeat: not his home).

How can I do this?
How can I configure sshd to obtain what I want?

How can I configure sshd to let ONLY some users (NOT root) connect to my machine?

Thanks in advance to anyone who can give me help...

so this user just needs to dump files?

consider sftp with ssh

when using the utility create user you can create their home directory anywhere

Yes, that is just what I want to do!

I will do

adduser -d /home/xxx/zzz/username username

but, which options should I specify to let the user access, view, modify or delete only files and subdirectories ONLY in his home directory?

He must have no access to any other directory-files-device on my linux box.

Any suggestion?
Bye

Please explain your motivation - what do you want him not to see?

The way to make his access as limited as possible is to put his user on his own group. But if all this user needs to do is to ftp then I would suggest some other seperate server software to control his access that doesnt give the user a shell.

Uhmm...

Maybe there is something that I don't know...

My user will use only sftp.

Is it possible to create a user only for sftp?
How can I make it?

Or should I create a linux user with only the privileges I mentioned above?

well you can grab a web app that allows uploads and downloads over https and auth_digest or something similiar. My point being if you don't trust this person at all and you have senesitive data on the machine giving this person access to openssh in any regard is probably not a good idea. There are also other ftp servers that are "secure", whereby you can limit all access to a particular directory..

There's actually a project, I think on Sourceforge, for "sftp-only" accounts. Basically it's the same idea as having a "nologin" shell, accept they must be able to authenticate as the user for SFTP, but you don't want them to be able to SSH into the machine.

I wish I had the link to it off the top of my head, but 2 minutes on Google should dig it up.

From the FAQ: Security references thread:

OpenSSH for chrooted sessions on Linux: http://mail.incredimail.com/howto/openssh/
http://chrootssh.sourceforge.net

OpenSSH, Scponly: http://www.sublimation.org/scponly/
Using scponly for secure file transfers: http://www.sancho2k.net/filemgmt_dat...s/scponly.html
OpenSSH, Rssh: http://pizzashack.org/rssh/

couldnt he chroot the users home directory so that the user only sees his home and whatever he creates in it?


ok i think that's what UnSpawns links are about but i started typing this so im gonna post it anyway.