SSH lock users to the Home Directory

Thread Tools Search this Thread
Operating Systems Linux Red Hat SSH lock users to the Home Directory
# 1  
Old 06-22-2011
SSH lock users to the Home Directory

Hi friends,

I must to give ssh connection to own customer.
So I want to lock ssh user on own home directory. It is not necessery to reach other folders. I know that ftp user can lock on own folder but I don't know how to lock ssh user.

I am waitting your kindly helps Smilie

---------- Post updated 06-22-11 at 10:12 AM ---------- Previous update was 06-21-11 at 11:44 AM ----------

I gave up this operation.
I have installed vsftpd on redhat but I have a problem again.
I gave error that "Listing remote folder failed" while I tried to connection.
If I stop iptables command with
#service iptables stop

I can connect to machine. Oddly enough there is a line for port 21 and 20 in iptables.

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 20 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

What can I do for this problem. I must start iptables but when I start iptables service, ftp daemon is'nt work.
# 2  
Old 06-22-2011
as far as SSH restriction to lock the users, you need to configure the restricted shell along with chroot.

FTP ..can u post the output how u r trying to access.

Customer who is getting the access what operations he is going to perform.
# 3  
Old 06-22-2011
I am using xftp application for testing. picture is attached. Customers can connect to their own folder. But now iptables status is stopped. If I start service of iptables that ftp connection will stopped.
Customes only uploading files to own folders. Later other customers are downloading.
I have created 3 users for 3 customers and 3 folders, thats all.

as far as SSH restriction to lock the users, you need to configure the restricted shell along with chroot.

I didn't understand what did you mean.

What can I do. Problem is iptables line or ......?
SSH lock users to the Home Directory-vsftppng
# 4  
Old 06-24-2011
Are you giving FTP access or SSH access...bcz the snapshot you can attached shows a FTP client..

If its FTP client you are rules are fine...once you ve enabled the iptables. cat /etc/sysconfig/iptables and paste the output.
# 5  
Old 06-24-2011
# service iptables status
Firewall is stopped.

# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

# netstat -tulpn | grep :21
tcp        0      0        *                   LISTEN      1869/vsftpd         

Why wouldn't I connect to ftp when service of iptables is started. I think lines are correct. Am I wrong?

When start service of iptables # service iptables start

picture of related error is attached.
SSH lock users to the Home Directory-ftp_errorpng
# 6  
Old 06-24-2011
Your IPTABLES rule looks OK.

Have you added connection tracking? If not, you need to edit the file /etc/sysconfig/iptables-config and add the ftp-specific connection tracking module to IPTABLES_MODULES
IPTABLES_MODULES="....  ip_conntrack_ftp"

Have you fixed up the SELinux contexts?
semanage fcontext -l | grep ftp
getsebool -a | grep ftp
man -k ftp | grep selinux

# 7  
Old 07-05-2011
I have stoped selinux and but I can't ftp when iptables is started.
# cat /etc/sysconfig/selinux

Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Permissions on a directory in /home for all users

Hi, I have created a shared directory on /home, where all users on a certain group have read, write and execute permissions. I did this using chmod -R g+rwx /home/shared/ The problem is, when a particular user creates a directory within /home/shared, other users are not able to write to... (8 Replies)
Discussion started by: lost.identity
8 Replies

2. Red Hat

sftp configuration | to lock users to their home folder.

In generally I use vsftp but I want to improve our security so I decide to use sftp instead of vsftp. We know that ssh,scp and sftp are in openssh server. How can I lock only sftp user to their home folder? And to prevent some users for sftp like root as such in vsftp daemon? (3 Replies)
Discussion started by: getrue
3 Replies

3. AIX

close ssh users to the home directory

Hello, I must close ssh users to the home directory. It means the users musn't see anything inside their home directory. For example after login to the os and type this command "cd .." or "cd /" it musn't work. How can I implement it? (Probably chroot or rootsh but how?) (1 Reply)
Discussion started by: jeszi
1 Replies

4. Cybersecurity

ssh many users to one home

Hey guys, Hmm.. I'm not quite sure where to open this. If any mod thinks this is not the place, please move it to wherever its suited :) So, I want to allow some trusted users to scp files into my server (to an specific user), but I do not want to give these users a home, neither ssh... (1 Reply)
Discussion started by: flpgdt
1 Replies

5. Solaris

Common Home directory for different users??

Hi Guys, I have a problem with configuring a server. this is a solaris 10 with sparc platform. I have setup so that the server is Authenticating through NIS but I dont want the server to Mount the Home directories. The users need to logged in through the CDE/display. I have over 200 users... (2 Replies)
Discussion started by: Luky
2 Replies

6. Linux

Lock User in home directory in ftp prompt

Hi, I am using Red Hat Enterprise Linux ES release 4 (Nahant Update 5). Here I have created one user with /sbin/nologin shll such that login is not possible only ftp is possible. But I want to do another thing that the user can not roam around after ftp. I had tried one way. in... (4 Replies)
Discussion started by: kallol
4 Replies

7. UNIX for Dummies Questions & Answers

lost /home/directory for users

I'm using HPUX 11i. The other day a user logon to the workstation and was not able to find the /home/directory (tom is the directory) I login myself and it is the same thing. The home directory is on the server, so I was thinking of using sam to map it again. does anyone know how to do it... (5 Replies)
Discussion started by: blizzgamer
5 Replies

8. UNIX for Dummies Questions & Answers

Home Directory Jail for Users

Hi, I am looking for a shell script (or any other way), that puts a user in a home directory jail. So for example, I have a user named richard and I don't want him wandering outside /usr/users/richard. I don't want him to cd to anywhere including cd .. Somebody said you can do that with... (3 Replies)
Discussion started by: mz043
3 Replies

9. UNIX for Dummies Questions & Answers

Profiles for users without home directory

Hi I want to know which profile will be called when a user without home directory is created. When I created a user without home directory(by setting in /etc/default/useradd), the user is able to login directly into the main "/" folder but with only read permissions. Thanks naina (3 Replies)
Discussion started by: naina
3 Replies

10. UNIX for Dummies Questions & Answers

Restrict users to ther home directory

Hello! I want users in a certain group to be restricted to their home directory. So that they have full access to all files and folders in their home directory but the cant go to any directory above. Does anyone know how to do this? Anders (1 Reply)
Discussion started by: alfabetman
1 Replies
Login or Register to Ask a Question