How do I allow users to have access to only a specific subset of folders on my Ubuntu server?

Question

I need freelancers to be able to download and upload files to some of my websites on my Ubuntu server, but not all.

How do I set it up so that each freelancer is a user who has access to only the sites that they should be able to access and nothing else?

I've followed the instructions I found to set up ftp users with access to particular folders via bind. I have added my ftp users to a group that has read, write access permissions to those folders, so all seems good from that perspective - my users can do what they need to do. But my ftp users are able to navigate to all the folders on my server and that is not good at all. How do I make sure that they are limited to their /home/thisuser folder and nothing else.

Answer 1

I'd use chroot. That's really your best option as you'll be 100% sure that nobody can view anything else than his "home" directory.

Answer 2

I'd use SUphp and make groups for the freelancers. You can then add write/read permission on the folder they need for their group.

Answer 3

I can't comment on your question as I don't have enough reputation yet, but is there a reason you are using FTP instead of SFTP? FTP will send passwords in the clear which is a very bad thing. SFTP will encrypt your exchanges between client and server.

Setting up an SFTP chroot is a several step process. These directions assume you have an ssh server installed.

1. In /etc/ssh/sshd_config replace the line

   Subsystem sftp /usr/lib/openssh/sftp-server with this:

   Subsystem sftp internal-sftp

   Following this line, add the following section:

   Match group sftponly

   ChrootDirectory /home/%u
   X11Forwarding no
   AllowTcpForwarding no
   ForceCommand internal-sftp

   ChrootDirectory /home/%u will force a user's home directory to be the root directory.

2. Create an sftponly group:

   sudo groupadd sftponly

3. Add all freelancers to the sftponly group and change the user's home directory:

   sudo usermod -g sftponly -d / johnnyfreelancer

   'sftponly' must be the primary group of the user (this is what the -g flag does), otherwise this method will not work. The -d flag is also necessary because once the user logs in /home/%u will effectively be the topmost directory for the logged in user.