how to jail ssh

[luv]

Hi,

I really tried searching the internet for so many hours on top of my work but I haven't found the answer so Im asking for help again.

Here's my problem. I have a hosting account and I created an FTP user for a subdomain. The user(outsourced developer) of that subdomain needs SSH for SVN. I performed this as suggested in one of the forums and it worked -- "usermod -s '/bin/bash' <username>". But the problem is that the user can read other directories on the system. I want the user to stay in his home folder, e.g. "/var/www/vhosts/mydomain.com/subdomain/ftpuser".

Please dont suggest something like jailkit because Im not an expert on this. I tried reading but I dont want to perform it because it might cause some problems that I dont know how to fix.

I hope you can help.

Thank you.

[alexshd]

Hi
If you are using RPM based distro /etc/security/chroot.conf file can help you.
If not tell me what distro are you ussing and I will try to help you.

[luv]

Hi alexshd,

In what way the chroot.conf file can help? Sorry, Im a complete noob when it comes to user management.

My web host has CentOS and I have Debian in the office.

Thanks.

Hi
If you are using RPM based distro /etc/security/chroot.conf file can help you.
If not tell me what distro are you ussing and I will try to help you.

[pnorten462]

I will search for this and than i will give you your answer.

[darkblue]

Oops, Sounds like you made the same mistake, I did couple of days ago!
here is what can be done..
First turn off your apache generosity,

setfacl -R -m o::---,default:o::--- dir

dir = e.g. "/var/www/vhosts/mydomain.com/subdomain/ftpuser"

now give some privileges to user

setfacl -R -m u:apache:r dir
setfacl -R -m u:headache:rw dir

lol... headache = person who is accessing things unnecessarily!

now turn off, file viewing generosity

setfacl -R -m o::---,default:o::--- dir

now play with apache:

setfacl -R -m default:u:$USER:rwx dir

again, dir = eg. "/var/www/vhosts/mydomain.com/subdomain/ftpuser"

setfacl -R -m u:apache:rwx dir

Lemme know if setfacl worked for you on your distro!


cheers!