I want to give SFTP access to user tom for directory /var/www/html/my_project/. while I don't want to give any SFTP access to directory /var/www/html/.

currently /var/www/html/my_project/ and /var/www/html/ is owned by apache user.I need to give access only to /var/www/html/my_project/ directory for both user tom as well as apache.

Once access is given tom can access all the directories which are under /var/www/html/my_project/.

Please help me I am struggling since a long time.

  • What do you mean by access? read? write? both? – Volker Siegel Sep 9 '14 at 12:04
  • @VolkerSiegel yes read+write both – prashant thakre Sep 9 '14 at 12:38

I use something like the following in my /etc/ssh/sshd_config file:

Match User tom
ChrootDirectory /var/www/html/my_project/
AllowTcpForwarding no
X11Forwarding no
ForceCommand internal-sftp

Then, make sure tom has permission to access that directory. This can be tricky as tom would need at least 'x' (execute) permissions for all directories above the intended directory. /var/www/html/ is usually accessible to everyone in most flavors of Linux/Unix.

I would probably make the my_project directory owned by tom, and have tom in the apache group. If apache is running as apache:apache (user:group), the following should work for that:

From http://www.cyberciti.biz/faq/howto-linux-add-user-to-group/

# usermod -a -G apache tom

Make whole my_project directory owned by user tom and group apache.

# chown -R tom:apache /var/www/html/my_project/

Make whole my_project directory fully writable to tom, and readable/executable to the apache group.

# chmod -R 750 /var/www/html/my_project/

Note: Any files that tom creates will be owned by tom's user and his default group. The above example adds tom to the group apache, but doesn't make apache his default group. This means the apache server won't have access to new files. To fix that, make apache be tom's default group by useradd -g apache tom.

  • So how would you use that to restrict a user to a directory tree? – G-Man Says 'Reinstate Monica' Sep 9 '14 at 22:50
  • The ChrootDirectory /var/www/vhosts/website.com/ restricts the user to the /var/www/vhosts/website.com/ directory. When they SFTP in, that is their root, /. – Beshoy Girgis Sep 9 '14 at 22:52
  • What user? If this is a file under /etc, it applies to all users. – G-Man Says 'Reinstate Monica' Sep 9 '14 at 22:55
  • I don't understand your question. The user is defined in Match group website_ftpuser. – Beshoy Girgis Sep 9 '14 at 22:56
  • More can be found at tutorials like howtoforge.com/… -- starting at step 3. – Beshoy Girgis Sep 9 '14 at 22:57

You can maybe chroot the user tom in the /var/www/html/my_project/ by correctely configure your SFTP server. The access from apache will be allowed, and tom can't go up its chroot dir.

To help you more, you need to say what SFTP server you are using.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.