Regular and restricted sftp accounts.

[Kathy McGohan_1]

Because of our security guidelines, users’ home directories cannot be any greater than750, but we need the directories and files to be 770. This is because our development group needs to be able to get into the users’ home directories and also be able to push and pull files if need be. We will eventually have several hundred users with sftp accounts and their shell is set to /usr/bin/false.

We have set up restricted accounts so that when these users sftp into our server, they land in their home directory and they can only go to their incoming and outgoing directories, but no where else.

Does anyone know how we can set up these sftp accounts so that when the user sftp’s into our server, it will take them into another directory, other than their own, which would be located on a separate filesystem? We can set permissions to 770 on directories outside of the users’ home directories.

The customer would also like to be able to have this new filesystem setup in Serviceguard for failover. We do not have vg00 configured in Serviceguard to failover, only our application filesystems.

[Steven E. Protter]

Shalom,

Whether the login is sftp or ssh or telnet, chroot restrictions apply. If you want for sftp wider access then you need another account.

The account can be one way or the other, but not both. If wider access is required then the chroot configuration, which is what your "We have set up restricted..." paragraph is saying.

SEP