FTP, SFTP and SCP accounts are often restricted to their home directory, so the users don't mess around with the system. This is done using 'chroot'. You can set up SSH demon or FTP server so the user cannot leave his home directory. But what if you want to give him access to some other directory outside his home directory?
The first thing that comes to mind is links. Soft links don't work, though, because the user cannot see anything outside his directory. Hard links won't work, either, because you usually cannot hardlink directories. They'll do if all you want is access to a single file, though. Also, you can change the user's home directory to the directory you want him to modify. But you may want to grant access to more than one directory. Besides, the implementation of chroot requires that if the user is chrooted to /var/data/lib/img, all directories up the tree (i.e., /var, /var/data and /var/data/lib) must belong to root and nobody else should have write permissions there. This is not always possible.
But the right solution would be to mount a directory to your home directory using bind option. Create the mountpoint inside the home directory and mount:
mkdir /home/remote/img mount --bind /var/data/lib/img /home/remote/img
Now, the user will be able to work with /var/data/lib/img, but not with any other data on the server.
To make the mount persistent across reboots, add the corresponding entry to /etc/fstab:
/var/data/lib/img /home/remote/img none bind 0 0
No comments:
Post a Comment