<p dir="ltr">That looks quite interesting. </p>
<div class="gmail_quote">On Aug 21, 2015 3:40 PM, "James Sumners" <<a href="mailto:james.sumners@gmail.com">james.sumners@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Just stumbled across this -- <a href="http://mysecureshell.readthedocs.org/en/latest/" target="_blank">http://mysecureshell.readthedocs.org/en/latest/</a><div><br></div><div>It's a bigger hammer than I want to use for the scenario in this thread, but it looks like a interesting tool for other locked down SSH situations.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 21, 2015 at 12:23 PM, James Sumners <span dir="ltr"><<a href="mailto:james.sumners@gmail.com" target="_blank">james.sumners@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><span><br><div class="gmail_quote">On Fri, Aug 21, 2015 at 10:01 AM, DJ-Pfulio <span dir="ltr"><<a href="mailto:djpfulio@jdpfu.com" target="_blank">djpfulio@jdpfu.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Just riffing here ... "bind mount" from ~T1000/dept-fun-times/ to their own area?</blockquote></div><br></span>I think that's going to work.</div><div class="gmail_extra"><br></div><div class="gmail_extra">1) Create `/home/t1000/dept-fun-times/`</div><div class="gmail_extra">2) Create `/opt/container/dept-fun-times/output` (and give t1000 group +rwx)</div><div class="gmail_extra">3) Bind `/opt/container/dept-fun-times` to `/home/t1000/dept-fun-times`</div><div class="gmail_extra">4) Set `Subsystem sftp internal-sftp` in sshd_config</div><div class="gmail_extra">5) Create match rule in sshd_config to chroot those users to `/opt/container/dept-fun-times`</div><div class="gmail_extra">6) Win<br><br clear="all"><div>Thank you for the (relatively) simple solution.</div><span><div><br></div>-- <br><div><div dir="ltr"><div><div dir="ltr"><div>James Sumners<br><a href="http://james.sumners.info/" target="_blank">http://james.sumners.info/</a> (technical profile)</div><div><a href="http://jrfom.com/" target="_blank">http://jrfom.com/</a> (personal site)</div><div><a href="http://haplo.bandcamp.com/" target="_blank">http://haplo.bandcamp.com/</a> (band page)</div></div></div></div></div>
</span></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr"><div><div dir="ltr"><div>James Sumners<br><a href="http://james.sumners.info/" target="_blank">http://james.sumners.info/</a> (technical profile)</div><div><a href="http://jrfom.com/" target="_blank">http://jrfom.com/</a> (personal site)</div><div><a href="http://haplo.bandcamp.com/" target="_blank">http://haplo.bandcamp.com/</a> (band page)</div></div></div></div></div>
</div>
<br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div>