I've read a lot of pages about jailing users and now I'm confused. I want to jail my users to their dirs on sftp and ssh access, so they could see only files in /home/. What solution I should use to do it in the best (and easiest as possible) way?  I'm new in linux and I still can't get it xD
19208
I want to give a client access to my server, but I want to limit those users to their home directories. I will bind-mount in any files I want them to be able to see.  I've created a user called bob and added him to a new group called sftponly. They have a home directory at /home/bob. I've changed their shell to /bin/false to stop SSH logins. Here is their /etc/passwd line:  bob:x:1001:1002::/home/bob:/bin/false   I've also changed the /etc/ssh/sshd_config to include the following:  Match Group sftponly         ChrootDirectory /home/%u         ForceCommand internal-sftp         AllowTcpForwarding no   When I try to log in as them, here's what I see   $ sftp bob@server bob@server's password:  Write failed: Broken pipe Couldn't read packet: Connection reset by peer   If I comment out the ChrootDirectory line I can SFTP in but then they have free rein over the server. I have found that ChrootDirectory /home works, but it still gives them access to any home directory. I have explicitly tried ChrootDirectory /home/bob but that doesn't work either.  What am I doing wrong? How can I limit bob to /home/bob/?  ----EDIT-----  Okay so I just had a look at /var/log/auth.log and saw this:  May  9 14:45:48 nj sshd[5074]: pam_unix(sshd:session): session opened for user bob by (uid=0) May  9 14:45:48 nj sshd[5091]: fatal: bad ownership or modes for chroot directory component "/home/bob/" May  9 14:45:48 nj sshd[5074]: pam_unix(sshd:session): session closed for user bob   I'm not entirely sure what's going on there,  but it suggests something is wrong with the user directory. Here is the ls -h /home output:  drwxr-xr-x 26 oli      oli      4096 2012-01-19 17:19 oli drwxr-xr-x  3 bob      bob      4096 2012-05-09 14:11 bob
114477
Given a non-root user "joshua", as root I created a file called "foo" at joshua's home directory (/home/johsua/); it look like this:  -rw-r--r--  1 root   root       0 12-19 21:00 foo   and then delete it as joshua, i can delete it successfully.  I would expect that joshua doesn't have enough permission to delete it. Is it some kind of 'Permissions inheritance'?  My platform is Debian 5.0.7.
4759
Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. Suppose also that I want to grant that user access at some point; how do I enable it again? I am using Ubuntu Linux 10.04. It would be nice if anybody show me how to do it from the command line, as I often login to the machine using a local ssh login.
75470
I accidentally moved all folders from root to a subfolder. (/bin, /etc, /home, /lib, /usr... all moved) The only ones that were not moved, since they were in use, are  /bak, /boot, /dev, /proc, /sys.  Now, any command that I try to execute will simply not happen. I constantly get "No such file or directory".  I am connected through ssh and through ftp, but I cannot move files through ftp, as direct SU login is disabled. I also have access to the actual server if I need to do something directly from there.  I'm assuming I would need to edit a configuration file in order to tell it where to find the /bin folder and that would help me get access again, but I don't know which file that would be or how to do it (since I can't even run chmod to change permissions).  Is there any way out of this other than re-installing?  I am working on an old version of CentOS.  I'm extremely new to the world of Linux, hence this action and the question...
96517
Usually, I use the scp command to transfer files on *nixes.  What's the difference between SFTP and SCP? Don't they both work on SSH?
94261
How can I restrict user from deleting files?   The user should have read and write rights, but the delete rights should be denied. In Windows the same task can be done easily, but I don't know the way to do this in Ubuntu.
104267
i want to enable access to a  home dirs via ssh/scp with an key. Normally i would place the pub key into ~/ssh/authorized keys But i want    disable the ability to add or remove ssh-keys (turn off ~/ssh/authorized_keys) The user should not be able to rm -f pub_key, modify pub_key wherever it sits in the system make the directory where the pub keys for different accounts are stored not readable for "normal" user, e.g. like /etc/sudoers.d/ is only readable by root1   Is that possible? How would i do that?
65124
My question would be a little bit silly, but who knows because linux is a very rich and sophisticated OS.  Is there a way that a normal user in ubuntu can hide some files from root ?  I know that the root has all privileges ans rights. But, if a simple user can keep files from root that would be awesome and very useful for me.
36681
I have a couple of files that I want to move to another's user home directory. I don't have permissions to write to that user's home directory, but I know his password.  I know how to copy the file using scp (see ). However, if I want to move the file, copying and then removing the original file is inefficient. Is there a way to move the file, without using sudo (I don't know the root's password)?
82035
How can I restrict certain file extensions and file upload size via SSH?  I am using Ubuntu 12.10 default installation and Open-ssh server.
2188
Ok I just royally screwed up my /var folder's permissions.  I thought I was inside /var/www and did a chmod xxx ./* on the parent folder /var instead.  Now all the permissions inside /var are messed up. What can I do to correct it?
100329
I recently set up a new server with Ubuntu karmic 9.10, and when I created my home directory I chose to make it encrypted. Now, after loading my authorized_keys file into ~/.ssh, it isn't recognized because my home directory isn't decrypted until after I log in. Is there a way to make SSH keys work with encrypted home directories under Ubuntu?
79014
I would like to give read-only access to a user but I want him/her to see only the exact folders I give access. for example he/she shouldn't travel around all the server and browse to all users folders etc. even if he/she only goes up, up, up I want him/her to go to only these specific folders I allow. So firstly how can I let a specific user have access to a specific folder and then would putting symbolic links to his/her home folder would help? So they can go directly to necessary folders but not up or down?
56602
I installed SSH, but I found if I use my original account to login to Ubuntu, it has too many permissions.  I want to constrain the user to only have permissions for specific folders in Ubuntu. How can I configure such a user?
78207
I was browsing through some Linux questions and saw this interesting question.   What steps to add a user to a system without using useradd/adduser?  The one possible way that comes to my mind is,   Add an entry for the user in /etc/passwd file.  Add an entry for the group in /etc/group file.  Create the home directory for the added user. Set the new user password using the passwd command.    I tested the above approach and it worked fine.   Is this the only possible way or is there any other work around to achieve this?
42885
I am trying to copy a folder to remote Ubuntu server using command line ssh connection, i understand it's doable to transfer a file using scp but i have many files in a folder iam trying to copy to that remote server, how is that done? anyone?  Thank you.
117741
The setup is we have a VPS running Debian Squeeze, and I've set up a shared directory for us to share files.  So far I've followed this guide:    I've also set the umask to 002 correctly (see the comments on that guide), so we can both now create files and directories directly on the server and we both have read/write permissions on them.  The only problem is that a lot of our files are created on our local machines (both running Ubuntu 10.10), and then dumped on the server.  This results in only the creator of the file/directory having write permissions on, and the other member of the group I set up for sharing this folder only having read access.  My next thought would be to change the default umask on our local machines, but it seems a bit extreme to have to do that, and I don't know if it's a security risk.  Can someone tell me if there's a better solution to what I'm trying to achieve, or if this really is the way to go?  Many thanks in advance