How can I make a shared directory accessible by SFTP?

Question

I have set up an sftp account in /home/sam, created a group sftp, and added the user sam in it. i gave chown sam:sftp /home/sam for the user to perform operations in that directory.

Now I have created another sftp account tom and I have to make him share the directory /home/sam. i.e., both sam and tom has to share the same directoy for common files. Now I can't give chown tom:sftp on /home/sam. How do I make the directoy sam shareable to both users?

Answer 1

Assuming a commonly used linux distribution and sshd service running.

1) If you want two users to be able to create, delete and modify files under the same directory, then just create one account and provide the credentials to both people. That's the easiest way, however...

...if you want to log their activity separately, e.g. who logged when, then create two users with the same group and assign the same home directory to both of them. E.g.

groupadd sftp
mkdir /home/sftp
chown nobody:sftp /home/sftp
chmod 770 /home/sftp
useradd -d /home/sftp -g sftp sam
useradd -d /home/sftp -g sftp tom

if users sam and tom already exist and have their own primary group, then chmod g+s /home/sftp will force files created under this directory to inherit its group id.

Check this other post for how to force a default umask under sftp, so files uploaded are group read/write-able.

2) If you want only one user to create, delete and modify the directory contents and a second user to have read-only access. This doesn't really need any special handling, normal users can read contents from other users' directories. The second user will just have to specify or cd to the target directory (however, you may assign the same home directory to the second user).

Answer 2

And one for Debian/Ubuntu 10.10 at least, using ACL, though it works the same on other Linux distributions with slight differences.

Create the users, sam and tom, having the home directories, /home/sam/ and /home/tom/. Create the group, sftp, for the purpose of sharing files. Make sure the users are in the sftp group.

Now use ACL (Access Control Lists) to refine permisisons. First add the acl option to the mount options of the file system that contains the shared directory.

sudo -e /etc/fstab

You might see something like this (add the ,acl portion):

UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx / ext4 defaults,acl 0 1

Then, remount the file system with acl enabled:

sudo mount -o remount,acl /

Install the ACL tools:

sudo apt-get install acl

Create a directory for the group to share files, maybe /home/sftp/; set permissions.

sudo mkdir /home/sftp
sudo chown -R root:sftp /home/sftp
sudo chmod 0775 /home/sftp
sudo chmod g+s /home/sftp
sudo setfacl -d -m u::rwx,g::rwx,o::r-x /home/sftp

Or, should these files NOT be available to "other" users (root and sftp group members only)?

sudo mkdir /home/sftp
sudo chown -R root:sftp /home/sftp
sudo chmod 0770 /home/sftp
sudo chmod g+s /home/sftp
sudo setfacl -d -m u::rwx,g::rwx,o::--- /home/sftp

If we wanted to restrict delete and rename from all but the user who created the file:

sudo chmod +t /home/sftp

To add another user to this group:

sudo usermod -a -G sftp $username