To: cygwin AT cygwin DOT com
From: JMCColorado <joshuamcoffman AT hotmail DOT com>
Subject:  Re: Lock down CYGWIN SSH User to single directory.
Date: Thu, 17 Nov 2005 20:08:27 +0000 (UTC)
Lines: 40
Message-ID:  <loom.20051117T210349-103@post.gmane.org>
References:  <loom DOT 20051117T181458-376 AT post DOT gmane DOT org> <dlilp6$ekj$1 AT sea DOT gmane DOT org>
Mime-Version:  1.0
Content-Type:  text/plain; charset=utf-8
Content-Transfer-Encoding:  8bit
User-Agent: Loom/3.14 (http://gmane.org/)
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

René Berber <r.berber <at> computer.org> writes:

> 
> JMCColorado wrote:
> 
> > Is there any way to only allow a user SSH access to a single directory tree?
> > I need to lock the user out of EVERYTHING else.
> 
> You need something like this:
> 
>   http://olivier.sessink.nl/jailkit/index.html#intro
> 
> It hasn't been tested under the Cygwin environment and it's not trivial to 
install.
> 
> Another option is to use a patched sshd that suports 'ChrootGroups' or
> 'ChrootUsers', there is:
> 
>   http://chrootssh.sourceforge.net/
> 
> Since chroot is part of the Cygwin's coreutils package, it may work.
> 
> I haven't used any of these, nor do I need it (so far), but it would be
> interesting to hear if anyone had any success with this.
> 
> HTH


I have heard that CHRoot might work, but I have also heard that it still allows 
someone to SCP outside of where they can SSH to.

I need to ensure that the user can't get anywhere but the one directory I want 
them to have access to. Unfortunately, with Windows giving "Everyone" access to 
just about everything, this seems very difficult to do.

Any more ideas?

Thanks for everyones input!

- Josh


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/