3

I am running CentOS, where I have users in a chroot SFTP setup. They are chrooted to their home directories. These users belong to the group 'sftponlyusers'. I allow these users to upload to a directory within their called 'upload' The current ACL permissions for the 'upload' directory are:

getfacl upload
# file: upload
# owner: root
# group: root
# user: rwx
user:sftpuser1:-wx
group::r-x
group:sftpfileadmins:rwx
mask::rwx
other::---

I have a few users in another group called 'sftpfileadmins'. These are users that will be able to move/copy/archive the files that the sftponlyusers place in the upload directory.

sftpuser1 is able to login and place files in their /user/upload directory. However when they do so they are always the owner of the file, and the file always has the following permissions:

getfacl file.txt
# file: file.txt
# owner: sftpuser1
# group: sftponlyusers
user::rw-
group::---
other::---

This means that the sftpfileadmins cannot perform any operation on the file (they can't move, copy, or read it).

I need help to figure out the correct combination of permissions that would allow sftpuser1 to only write to the directory, while users in the group sftpfileadmins would be able to both read and write.

Improve this question

1 Answer 1

Reset to default
3

This problem is resolved with the latest update (openssh-6.6.1p1-32.el7_3). This is known bug.

Cross-duplicate post discussing the same issue on SuperUser.

Improve this answer
7
  • Do you know if there are any issues updating to this version of openssh using the default centos7 repo?
    – ts1
    Feb 16, 2017 at 15:47
  • This is bugfix release so it fixes this problem and to my best understanding should not break anything else.
    – Jakuje
    Feb 16, 2017 at 15:50
  • Do you happen to know if adding a umask attribute in sshd_config would be a workaround for the issue? Thanks for all the assistance!
    – ts1
    Feb 16, 2017 at 16:15
  • No. The problem is in the group initialization, which was wrong. Umask does affect only resulting permissions on the created files.
    – Jakuje
    Feb 16, 2017 at 16:18
  • I think that was my point though. If I use a umask to set the resulting file permissions on the files that the sftpuser1 is uploading, say 755, then I should be able to copy/move/archive them with the account belonging to sftpfileadmins group. I apologize if this does not make sense, haven't been working with linux for very long.
    – ts1
    Feb 16, 2017 at 16:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .