I have been able to find a lot of help with jailing a user to their own home folder and restricting them only to sftp but I working on a more advanced solution.
What I am trying to do and can't find any docs on is I want to restrict sftp access for a user but give them access to a site folder inside another user's home folder.
Two users - u1 and u2 two home folders - /home/u1 & /home/u2 u1 has a website in a subfolder - /home/u1/public_html/site1/ I want to jail u2 to user u1's site1 folder above. Could use some help on doing that.
Notes: - I can't use something like vsftpd because I have the system locked down pretty good. - user u1's site1 folder's chown is u1:www-data and I would like to be able to keep it that way if possible. I read that in order to chroot the folder has to be owned by root:root but this would screw things up on the webserver side I think. - If I need to use vsftpd I just need help understanding how to keep the system secure at the same time.
Thanks in advance for your help.
UPDATE1:
added a user u2
setup the private ssh keys
changed the /home/u2 ownership to root:root
modified the /etc/ssh/sshd_config file:
#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp -u 0002
Match User u2
ChrootDirectory /home/u2
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
added u2 to the www-data group
added a folder /home/u2/site1
binded the u1 folder I need u2 to have access to with this command:
sudo mount --bind /home/u1/public_html/site1/public /home/u2/site1
changed all permissions of all files/folders within /home/u2/site1 to include write permissions for the group:
chmod -R 775 /home/u2/site1
make all future files/folders belong to www-data:
chmod g+s /home/u2/site1/
switched to both users and made new files/folders have group write permissions:
umask 002
went in to u2 /home/u2/.bashrc AND /home/u2/.profile and added umask 002 at end of each file
Everything is working - u2 can not ssh in but can sftp in and can only see /home/u2 and above. BUT, I still can't get any new files/folders to automatically have group write permissions. Any help would be great. Thanks.
UPDATE2:
Ok, did a couple of tests. Weird results:
created a folder through sftp with u2 called test and it had the permissions rwxr-sr-x (755 right?) and was able to sftp in as u1 and was able to go into that folder but not upload a file but was able to delete that folder.
As u1 I was able to upload a file and it's permissions became rw-rw-r-- (664) like we have been trying to do. Also as u1 I created a folder named test2 and it gave the permissions of rwxrwsr-x(775) like we wanted also.
As u2 I am able to sftp into folder 2 and upload a file but the permissions are still rw-r--r-- (644) but CAN delete it with u1 sftp.
I think there is something going on with the jail or something with the u2 account not letting a certain service run or something that will let the proper umask take hold. Thoughts?
UPDATE3
Ok, tried something and it worked. Confusion for sure! Hopefully someone can explain why it worked.
In the /etc/ssh/sshd_config file I commented out the line ForceCommand internal-sftp and restarted ssh and it worked. Happy but confused. Thanks.
Match User u2
ChrootDirectory /home/u2
X11Forwarding no
AllowTcpForwarding no
#ForceCommand internal-sftp
