I'm setting up my first Linux Fedora box and noticed that my test user account can view the root dir in addition to the home dir. I'm using SFTP to connect to it. How do I limit the user to the home directory?

You will want to add the following lines to your /etc/vsftpd/vsftpd.conf

chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list

The first line tells vsftpd to limit (chroot) the local users (users on the system) to their own home directories.
The second line tells vsftpd that there are exceptions to the above rule.
The third line specifies the file in which the exceptions (users who should NOT be chrooted) are listed.

Hope that helps.

Thanks osdeals,

Unfortunately, that didn't work and I don't know why. This is a brand new installation of Fedora. Prior to installing the vsftd package, I was able to sftp into it and ran into this problem. I thought that installing vsftd would fix it but it didn't.

Is there somewhere else I should look or something else I should change?

My client machine is running OSX 10.4 and is using Cyberduck to SFTP into my Fedora box.

sftp is actually unrelated to vsftpd (or any other FTP server for that matter).

sftp is part of the ssh subsystem (and so is scp), and hence unrelated to any FTP server.

The modifications to vsftpd will ensure that all users are restricted to their home directories when they FTP to the server.

If you want to restrict a user to only their home directory while using sftp, you will probably want to first restrict the user to their home dir (when they login to a shell via ssh / console).

To do this, you will want to change the users shell to /bin/rbash .

One way to do this is:
1. cd /bin; ln -s bash rbash
2. edit /etc/shells, and add a line /etc/rbash at the end.
3. usermod -s /bin/rbash -d /home/username/./ username

This way, you're actually restricting the user from moving out of his / her home directory while logging into the machine itself. sftp should now restrict the user to his / her home directory.

Hope this helps.

I reallllly appreciate you taking the time out with this. I did exactly what you said and I can no longer successfully log into the server. I get this error:

SSH Error: Listing directory failed
/home/username
The SFTP Subsystem could not be initialized

In the User Manager, the Login Shell for the account is /bin/rbash and the Home Directory is /home/username/./

However, when I change the Login Shell back to /bin/bash I can log in, but I still can see the root directory. *shrug* Any thoughts?

hmmm... i just simulated the same on a CentOS 4.4 box and WinSCP as client (using only the sftp protocol) and i couldn't login as well. Quite strange actually.

I was very much able to login via scp while being restricted to just my home directory. Checked with a regular ssh as well, and i still couldn't get out of my home directory. So the method works perfectly, but just not with SFTP.

Very strange! sftp and scp are both part of the ssh subsystem. I believed they behave identically.. Guess I was wrong in that belief. My apologies!

Till someone is able to figure this one out, perhaps you might want to consider using SCP instead of SFTP (both are equally secure) keeping the recommendations from the last post intact.

A good SCP / SFTP client for MacOS X would be http://rsug.itd.umich.edu/software/fugu/

My passwd file shows "testuser:x:504:100::/home/testuser/./:/bin/rbash" , and it worked perfectly with SCP & SSH.

Hope that helps.

As an alternative to SFTP, you can setup vsftpd to use secure connections.
See Linux homeserver howto, chapter 14 FTP server.
Not sure which client can handle it on OSX.

I'll have to give this a try. In the meanwhile, is it really that difficult to limit sftp users to their home directory?