Access only specific folders via SFTP

Question

I have a VPS running Ubuntu Server 14.04.

Here's a selection of my directory structure:

/
    home/
        my_user/
    var/
        www/
            wp-content/
                themes/
                    my-theme/
                    my-theme-child/

Permissions for the directories are 755 and files are 644.

Say I hire a developer, my_user, to work on a theme for me. I want them to be able to do anything they want to their home folder. I also want them to be able to read my-theme and read and write my-theme-child, but nothing more. They shouldn't even be able to see the directory structure of any other part of the server.

I've done some reading and I think a chroot jail would work nicely to keep my developer in their home directory, but I can't figure out how to give them access to my-theme and my-theme-child in addition to their current access.

How can I achieve this?

Answer 1

This might be meh for your needs, but I do something similar for letting friends send me files. Assuming your SFTP jail is set up, you can do:

1) Make a home directory for this chrooted myuser. I did mkdir /var/sftproot

2) The user's home directory should be owned by root: chown root:root /var/ftproot

3) mkdir /var/ftproot/dump (inside the chroot jail) and /var/dumpstuff (outside the jail)

4) chown -R myuser:users /var/ftproot/dump and chown -R myuser:users /var/dumpstuff (if you want the user to own it)

4) mount --bind /var/ftproot/stuff/ /var/dumpstuff/

/var/sftproot is not writable by myuser, but the subdirectories in it are. This probably limits them to using sftp; no shell access.

You don't say whether you want shell access for this developer, but since it's a developer maybe you do. For that, consider ssh and a jail (this is for Arch, but something similar is probably possible on Ubuntu - I didn't test it).