How can I prevent users from accessing the root directory?

Question

While still allowing my account to access the root directory. I've tried adding myself to the root group with $ sudo adduser myaccount root but when I do $ sudo chmod o-r /etc followed by $ cd /etc $ dir it says permission denied.

Maybe I'm thinking about the wrong solution for my problem. I setup an ssh server with OpenSSH and want to give users the ability to navigate and edit files in a specific folder /home/myaccount/website/deveopment/ without giving them the ability to view or edit anything else.

To solve that problem, I'm attempting to disable 'other group' read permissions from every folder in root so that only root can access them. That's when I ran into the above problem. Even after adding myself to root, I still can't access directories with 'other group' read permissions disabled.

Solution 1

If all you want is for the users to be able to sftp files to/from a particular folder, why don't you set them up with an sftp chroot? This will make the folder you designate appear to be the root in their login.

See: http://www.debian-administration.org/articles/590 http://ubuntuforums.org/showthread.php?t=858475

Solution 2

sudo chown o-r /etc

should already give you an error, since chown doesn't know o-r; are you talking about chmod perhaps?

However, you shouldn't fiddle around with permissions of system folders. Programs will stop working, support advice will fail. I can't imagine a reason to forbid people to read /etc.

If you did only that, you should undo it, if you did such things recursively, you can do a reinstallation, which is faster than a manual correction.

A good idea would be to ask such questions before doing it. Davids advice, to use a chroot-environment, is the canonical way to prevent untrusted users to access your directory tree.

Comments

[aakash]

You're right, I meant chmod. Fortunately, I wasn't using -R so it was easy to change the permissions back. And it does look like chroot is the way to go, judging by the links he posted.

[aakash]

Thanks! That definitely seems like what I want. I'm currently in the process of trying to get it to work, but I'm running into problems. Looks like I need to read the configuration options for OpenSSH more closely.