Mac Geekery

Answer

It’s hard. It’s doable, but it’s a little bit complicated and involves recompiling OpenSSH and applying a third-party patch to make it work. This is because, as you note, OpenSSH does not have this feature because it wasn’t intended to work in that fashion.

That said, someone’s already gone through the trouble of writing up a set of instructions on how to accomplish this so I’d just go over those and see how they work. Now, surely, OpenSSH and chrootssh have had updates since then, so read both sites and find compatible versions before proceeding with it.

Now, one could setup a full chroot environment for every user, but real chroot is likely not what you want at all, so I won’t touch that. You want the above.

Or Use Permissions

Or, you can do it the really easy way and make a new user for secure communications and add that user to a new group, then give that group no access to roaming around the machine (ACLs are your friend). It’s easier, less hacky, and a slight bit more geeky and proper.

First, turn on ACLs on your boot volume and then restart (the volume must be remounted).

sudo fsaclctl -p / -e

Once you’re back, get the Server Admin Tools from Apple’s download site. Open the disk image and go to Installers/Packages and just install ServerAdminTools (the other is not useful to us and requires a restart). Once done, run Software Update to get the latest version.

Open Workgroup Manager and press ⌘D to get the local directory for your machine and then click on the lock below the toolbar on the right and authenticate as the local admin for your machine. Click on Accounts and create whatever accounts you want for this. Do the same for groups and add the members to the groups. Ensure you have at least one group all of these folks share for the next step.

Now that you have some people in some groups and one main group you can use to block access, read the section of the chmod manual page that talks about ACLs (in less just hit slash and type in ACL and press return). Once you realize what you’re doing, run the following for any items you want to prevent users in the group from descending into. You do not need to change child items; this blocks them from traversing into the item in question.

sudo chmod +a "evilgroup deny list,search" /System

Now anyone in evilgroup will be locked out of /System but anyone else can get inside.

Be very careful who you lock out of the core OS directories or the system may not start up properly. Never lock out the administrator or any pre-existing group, only users or groups you created.