Como eu crio um usuário com acesso somente leitura via SSH para uma subárvore limitada de pastas?

Question

Eu tenho um servidor Debian e quero dar a vários usuários acesso somente leitura a uma subárvore de pastas nesse servidor. Existe uma maneira de fazer isso sem alterar manualmente os direitos de todos os arquivos e pastas?

    

Answer 1

Se você realmente quiser restringi-los o máximo possível, sugiro olhar para uma instalação ssh com chroot. Dessa forma, mesmo que eles conseguissem quebrar a sua árvore, eles não seriam capazes de vasculhar o sistema subjacente.

Os caras do Debian têm um guia disponível sobre o assunto.

    

Answer 2

o original (do openbsd) sshd pode fazer um chroot completo, citando o sshd_config:

ChrootDirectory

         Specifies a path to chroot(2) to after authentication.  This
         path, and all its components, must be root-owned directories that
         are not writable by any other user or group.  After the chroot,
         sshd(8) changes the working directory to the user's home directo-
         ry.

         The path may contain the following tokens that are expanded at
         runtime once the connecting user has been authenticated: %% is
         replaced by a literal '%', %h is replaced by the home directory
         of the user being authenticated, and %u is replaced by the user-
         name of that user.

         The ChrootDirectory must contain the necessary files and directo-
         ries to support the user's session.  For an interactive session
         this requires at least a shell, typically sh(1), and basic /dev
         nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4),
         arandom(4) and tty(4) devices.  For file transfer sessions using
         ''sftp'', no additional configuration of the environment is nec-
         essary if the in-process sftp server is used, though sessions
         which use logging do require /dev/log inside the chroot directory
         (see sftp-server(8) for details).

         The default is not to chroot(2).

    

Answer 3

O rssh faz exatamente isso. De pizzashack.org :

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that. For a list of platforms on which rssh is known to work, see the Platform Support Page.