SFTP with chroot in a folder that can not have root privileges

Question

I have troubles with setup a SFTP with chroot in "public" folder. Each client on my server has 3 to X accounts.

These three accounts are:

• USER - system account only for internal use, requires full access to home dir of client
• USER-www - also system account only for internal use, every customer app works with this uid, and requires full access to serval sub-folders in USER home dir
• USER-ftp - account only for sftp access, with chroot id ~/apps

Problem is, that ~/apps doesn't have root:root privileges and can not have. Also i want have ability to create sub-accounts for USER-ftp, which have chroot in ~/apps/APP_NAME/app and full access in that directory (so ~/apps/APP_NAME/app folder must not have root:root privileges).

So, here are my questions:

1. Is SSH in any way allows to chroot user into dir thats do not have root:root privileges?
2. How to setup USER-ftp chroot dir into ~/apps, and all ftp subaccount into ~/apps/APP_NAME/app? Mention that part of your user name will also be the name of the folder to which will have access (eg. user USER.my_first_app-ftp will have chroot in ~/apps/my_first_app/app).
3. In addition, how to let the USER-ftp to log in as the USER, without '-ftp' and, eg. USER.my_fist_app-ftp as the USER.my_fist_app?

Answer 1

I'm not sure I understand your Questions, but I will try to answer.

1) You can change the location of the users Home foler in /etc/passwd. Then create groups for the users who need to be able to read/write to these folders and

chown -R user:group /the/new/homefolder

1a) The problem with sftp is that the users will still be able to read other dirs and files on the system, but not write or create.

2) Again you could do as mentioned in 1,

3) I don't understand this part - do you mean switch user when logged in? You can normally do this by:

su username

And type in the users password.