Using sftp ChrootDirectory while giving other users write access to the same directory

Question

I need to allow an untrusted user SFTP access to a particular directory under his webserver root. I don't want him to access any other parts of the system (including the rest of the web), so I thought about using OpenSSH's ChrootDirective. Essentially something like the approach described here.

However, it seems there is no way to do that, while simultaneously allowing the web server (or the git deploy script) to write to that directory, because as soon as I do that, I get a fatal: bad ownership or modes for chroot directory component "/srv/www/" error.

I have thought about creating the directory elsewhere and mount --binding it, but the limitation seems to apply to the chrooted directory and not only it's parents, so I get the same problem again.

I get that it's a security thing, but that's not really relevant here since:

• the other users are trusted (well, relatively, and they can't add suid files anyway)
• the untrusted user only has SFTP access, not SSH so they shouldn't be able to run anything either way

So, anything I've overlooked? Any sane ways out of that mess? (Without moving to FTP or setting up incron/rsync between 2 directories preferably.)

Answer 1

You could set the user's home directory to be his chroot folder, as described in the tutorial which you linked to. Then mount /srv/www/ onto a subdirectory of the user's home directory:

mkdir /home/jdoe/srv-www
mount --bind /srv/www /home/jdoe/srv-www

After connecting with sftp, he'd have to cd into the subdirectory to access the contents of /srv/www/. You could lock down permissions on the user's home directory and the other files there, if you wanted to.