3

Environment

  • Ubuntu 14.04.1 LTS server edition
  • OpenSSH_6.6.1p1 Ubuntu-2ubuntu2, OpenSSL 1.0.1f 6 Jan 2014

Current Configuration

SFTP password-protected accounts are setup for Alice and Bob. Their home directories are located at

/sftp/alice/
/sftp/bob/

Both accounts are chrooted which prevents them from leaving their home directory. SSH access is also disabled.

Desired Configuration

Alice and Bob should be allowed to create sub-directories, inside their home directories, and assign a username and password to said directories. For example

/sftp/alice/stuff_for_chris
username: chris
password: my_stuff

Alice then tells chris to SFTP to [email protected] where he can download his files. Chris should only have read access to /sftp/alice/stuff_for_chris

Question

  • Can SFTP accomplish this or do I need to use something like ProFTPD ?

1 Answer 1

4

As far as I know you cannot do this with SFTP nor ProFTPD. What I have done in the past with a similar requirement is to have program that runs as root scan the toplevel directories for an agreed upon file (in your case agreed upon with Alice and Bob e.g. account.new). Based on the content of that file the script run by root takes the appropriate actions, for which it has all the rights necessary.

Care should be taken not to execute any commands from account.new but interpret the contents and base a restricted set of actions on that content. The file could contain lines like

create charles
delete donald
deactivate eric
activate fiona

The program that runs as root could be a daemon that regularly checks the relevant directories for such a file, or if speed is important get triggered by inotify.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .