Is it possible to block users from leaving their home directory?

Question

I'm creating a webserver, and I will have many users ssh/sftp into it. All they need to do is within their home directory, for example, /home/user/.

Many people have told me to use chroot, but it seems like it's a little bit too much, plus I'm going to have multiple users log in into the server so it'll be just a huge load on the server.

So to recap, I want to prevent users from leaving their home directory, /home/user/. Is this possible?

Solution 1

Why would chroot be a "huge load on the server"? This is precisely what chroot was designed to do. There are guides aplenty on the internets that you can follow to get things set up.

Solution 2

SSH has built in chroot features for sftp, with ssh its a bit trickier since the users get to start a fully shell, but its also possible. Check out this howto:
http://www.howtoforge.com/chrooted-ssh-sftp-tutorial-debian-lenny

Comments

[Tim Brigham]

It is with chroot..

[samwell]

Would you recommend chroot with multiple users on the server?

[samwell]

I read that it can slow down the server and take more memory. Would you recommend it with multiple users ssh/sftp into the server?

[EEAA]

It's likely that things will be just fine. Just give it a try. If it doesn't end up working, nothing has been lost.

[jlecour]

A chroot does not imply a full OS copy. It depends on what you want available to a user once in the chroot. Also, there is no performance penalty or overhead.