Restricting a user to a certain directory on SSH login

Question

I am having trouble restricting a user to a fixed directory when they connect with SSH

I want the user restricted to /var/www/home however I connected myself and they are free to move about the system

I set the home directory to /var/www/home so they go there upon login however this doesnt restrict them.

I have tried a few things from suggestions in Google but nothing so far seems to work / do what I want

For example I have changed the chmod of www to 755 and root owned but still no effect

Answer 1

You will need to set up a "jail." From here:

Step 1: Set up the jail space

Make a new directory:

mkdir -p /home/test

Find the files that you need to support a session. Ideally you only want the bare minimum since the goal is to hide the rest of the system:

ls -l /dev/{null,zero,stdin,stdout,stderr,random,tty}

Now you can make the necessary /dev files. Here -m sets the permissions and c is for a character device and the two numbers are the major and minor device numbers:

mkdir -p /home/test/dev/        
cd /home/test/dev/
mknod -m 666 null c 1 3
mknod -m 666 tty c 5 0
mknod -m 666 zero c 1 5
mknod -m 666 random c 1 8

Now you can set the files to be owned by root and only writable by root:

chown root:root /home/test
chmod 0755 /home/test

Step 2: Set up the shell

First add the shell binary, for example bash:

mkdir -p /home/test/bin
cp -v /bin/bash /home/test/bin/

The figure out which libraries bash needs in order to run (NOTE: you may need more than just the lib64 libraries. For example mine are in /lib/x86_64-linux-gnu/ and /lib64):

ldd /bin/bash
mkdir -p /home/test/lib64
cp -v /lib64/{libtinfo.so.5,libdl.so.2,libc.so.6,ld-linux-x86-64.so.2} /home/test/lib64/

Step 3: Set up a user

First make the user and give them a password:

useradd sshguest
passwd sshguest

Now move over the required /etc files:

mkdir /home/test/etc
cp -vf /etc/{passwd,group} /home/test/etc/

Step 4: Configure sshd to use the jail

Use your favorite editor to add the following lines to /etc/ssh/sshd_config:

#define username to apply chroot jail to
Match User sshguest
#specify chroot jail
ChrootDirectory /home/test

Then load the new config by restarting the service:

sudo service sshd restart

Step 5: See if the shell works

You should be able to connect and run shell built-ins:

ssh sshguest@[IP of Host]
  $ pwd
  $ echo "foo"

Step 6: Give the new user a home directory and add other programs

First give the account a home:

mkdir -p /home/test/home/tecmint
chown -R sshguest:sshguest /home/test/home/sshguest
chmod -R 0700 /home/test/home/sshguest

Now for any program that you want the jailed shell to have access to you need to repeat copying over the binary and checking which shared libraries are needed and copying those over just as you did with bash. So if you want ls you would do:

cp -v /bin/ls /home/test/bin/
ldd /bin/ls
cp -v /lib64/{libselinux.so.1,libcap.so.2,libacl.so.1,libc.so.6,libpcre.so.1,libdl.so.2,ld-linux-x86-64.so.2,libattr.so.1,libpthread.so.0} /home/test/lib64/
### or whatever directory and libs you need on your system