Sign up ×

Instead of using...


I want to use


How would I do this? It would be good if users can't access /home, /var and such. I only need this for data transfers.

share|improve this question
How about a symlink? ln -s /mnt/thing/usr/prj /prj –  phunehehe Apr 2 '11 at 16:25
possible duplicate of Restricting an SCP/SFTP user to a directory –  Gilles Apr 2 '11 at 16:44
Concur. Pretty much the same issue. –  Shadur Apr 2 '11 at 17:19

2 Answers 2

Look into the scponly 'shell' and set up a chroot.

share|improve this answer

Create a user whose home directory is /prj.

Create a ~/.ssh/authorized_keys file for the user which contains the remote users public key, as well as some restriction on the commands and ssh options available, like:

ding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQA

Make it as restrictive as possible.

Then you'll need to create that wrapper for scp. Something as simple as the following will work, but you'll want to add more security conscious checks and tests before using it in production.

#!/usr/bin/env bash


This is just an example of what's possible. In this case, the full scp command is captured in the environment variable $SSH_ORIGINAL_COMMAND, but since you can't specify a command with arguments in the command= clause of the .authorized_keys file, you need the wrapper.

Users can probably still access sticky public directories, like /tmp, but they'll have no access to roam around /var, or /home.

and they may be able to pull files off your server, but you could wrap all this up with chroot, and secure the system quite a bit more, with minimal effort.

share|improve this answer

Your Answer


