openssh unix dev - Sep 2007 - sftp-server only in subdir possible?

I'm searching for a simple solution to allow access to only one 
directory of an existing user (that may not login) via sftp-server and 
authorized_keys file using the extended syntax

command="/usr/lib/openssh/sftp-server --root 
/data/exchange",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty
ssh-rsa AAA...keydata

Is something like that already possible, is there a better solution?

If not, how much effort for me would it be to implement it? I've already 
got the ubuntu sources and looked into the code a little bit. Is the 
chroot syscall after opening the root directory sufficient to make it 
work? Never programmed with chroot. Could such patch make it into the trunk?

DI Roman Fiedler wrote:
> I'm searching for a simple solution to allow access to only one 
> directory of an existing user (that may not login) via sftp-server and 
> authorized_keys file using the extended syntax
> 
> command="/usr/lib/openssh/sftp-server --root 
>
/data/exchange",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty
> ssh-rsa AAA...keydata
> 
> Is something like that already possible, is there a better solution?
I wrote a patch which could facilitate this. It allows requests (as 
defined in RFC 4254) to be controlled using a configuration like the 
following:

Match Group restricted
   GlobalReqDeny tcpip-forward
   GlobalReqDeny direct-tcpip
   ChannelDeny x11
   ChannelReqDeny shell
   ChannelReqDeny exec
   ChannelReqDeny x11-req
   ChannelReqDeny pty-req
   ChannelReqDeny env
   Subsystem sftp /usr/lib/openssh/sftp-server --chroot

The above would effectively only allow "session" channels to be opened
and only "subsystem" requests to be made for any user in the 
"restricted" group. So X11 requests of any kind, port forwarding and 
shell/exec requests would be disabled. There are loads of chroot patches 
around which you could use, but mine jails to the user's home directory.

The patch was meant as a proof of concept, which I'd tidy up if there 
was any interest. There wasn't any and it does everything I personally 
need, so has been stagnant for a while. Let me know if you want to take 
a look at it... I've even got a modified Ubuntu package.

Jon