1

I have a server running OpenSSH. I've setup an SFTP server that users can log into. I have created user userName with a folder at /sftp/userName with permissions of 555 and owner root. This folder has two subfolders, upload and download with permissions of 755 and 555 respectively. Both subfolders are owned by userName. I have setup my server to prevent userName from accessing anything outside of /sftp/userName and this folder acts as the root directory when userName is logged in.

My goals:

  • allow userName to login and see the download and upload folders within /sftp/userName.
  • prevent userName from uploading or downloading anything in the folder /sftp/userName.
  • allow userName to enter into download and download files but not upload files.
  • allow userName to enter into upload and upload/download/delete files.

All of this behavior works correctly and seems like a good setup for my situation.

My problem is that userName can change permissions on the upload and download folders using chmod xxx.

Questions:

How can I prevent userName from making changes to folder permissions on upload and download?

Are there other gotchas with my setup that I should be aware of?

  • I'd learn AppArmor because that's the sort of thing it is intended for. SELinux is also worth mention, but I think there is a much higher ramp-up cost and you don't mention government agency approval as a need. – msw Dec 31 '15 at 1:23
  • What is the meaning of acts as the root directory when userName is logged in? Does userName log in via ftp or ssh or what? – RobertL Dec 31 '15 at 2:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.