Creating a Locked user that has access to one dir

I'm trying to create a user that can only rwx from one directory with chroot.

they are uploading files using winscp.
I want to completely lock them to /home/user/upload (no other dirs)

anyone have a quick list of steps?  been trying to edit sshd_config for just that user but keep running into permission issue for directory.  what should they be?

Thanks

Ben

[Greg Woods]

On Thu, 2013-11-07 at 21:27 -0500, [e-mail] wrote:
> they are uploading files using winscp.
> I want to completely lock them to /home/user/upload (no other dirs)

I did this once, and I did it by giving the users a restricted shell,
which was a perl script that checked the arguments to be sure that they
were not trying to log in interactively (scp only), and not trying to
copy anywhere outside their home tree (done by checking for names
beginning with "/" or ".."). I don't know if that would be good enough
to block out a high-level adversary, but it worked for me.

--Greg

[Ian Malone]

On 8 November 2013 02:27,   wrote:
> I'm trying to create a user that can only rwx from one directory with chroot.
>
> they are uploading files using winscp.
> I want to completely lock them to /home/user/upload (no other dirs)
>
> anyone have a quick list of steps?  been trying to edit sshd_config for just that user but keep running into permission issue for directory.  what should they be?

Is this what you're doing?
http://www.techrepublic.com/blog/linux-and-open-source/chroot-users-with-ope...

[Greg Woods]

On Fri, 2013-11-08 at 08:29 +0000, Ian Malone wrote:
> http://www.techrepublic.com/blog/linux-and-open-source/chroot-users-with-ope...

That looks a lot less kludgy than my "third party hack". I don't think
this was available when I did it (back in my Solaris days, mid-90's or
so).

--Greg

[Rick Stevens]

On 11/08/2013 06:02 AM, Greg Woods issued this missive:
> On Fri, 2013-11-08 at 08:29 +0000, Ian Malone wrote:
> > http://www.techrepublic.com/blog/linux-and-open-source/chroot-users-with-ope...
>
> That looks a lot less kludgy than my "third party hack". I don't think
> this was available when I did it (back in my Solaris days, mid-90's or
> so).

You can chroot an scp user through the standard sshd_config options
"Match User" and "ChrootDirectory" options (see "man sshd_config"). You
can sort of think of it as a ssh/scp chroot jail like FTP. We do it all
the time.
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, AllDigital    [e-mail] -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-               500: Internal Fortune Cookie Error                   -
----------------------------------------------------------------------