1

I have a basic SFTP server setup using OpenSSH. To setup the SFTP server, I followed these steps:

Step 1: I installed the OpenSSH package.

sudo apt-get install openssh-server -y

Step 2: Created separate group for SFTP users.

sudo groupadd sftpaccess

Step 3: I edited the /etc/ssh/sshd_config file by finding Subsystem sftp /usr/lib/openssh/sftp-server and commnting it out. After that I went to the very bottom of the file and added this:

Subsystem sftp internal-sftp
Match group ftpaccess
ChrootDirectory %h
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

Step 4: Restarted the sshd service.

sudo /etc/init.d/ssh restart

Step 5: Added User with sftpaccess group and create password

useradd -s /bin/bash -m -U -G sftpaccess sftp-alex
passwd sftp-alex

Step 6: Create and Modify user directory.

sudo mkdir -p /mnt/users/sftp-alex/www
sudo chown root:root /mnt/users/sftp-alex
sudo chown root:sftpaccess /mnt/users/sftp-alex/www

My goal (The thing that is stumping me):

  1. I want to create a directory here (/mnt/www) for something like a user share and then bind that to /mnt/users/sftp-alex/www so it would look something like this:

    • Making the user share: mkdir /mnt/www
    • Binding share to users mount --bind /mnt/www /mnt/users/sftp-alex/www
  2. The next thing in this process is to create a sharing system/permissions system. My thought on how to do this is pretty straightforward in execution. I want to create two groups, one called sftp_read_write and the other one called sftp_read now if you can't already tell where I am going with this then let me explain. I am going to be using setfacl to add acls to files and folders. My thought was something like this setfacl -Rm g:sftp_read_write:rwX,g:sftp_read:rX /mnt/www. Now this is all great and all but it does not work I can read and write whether I am in sftp_read_write or sftp_read or sftpaccess

I really need help figuring this out I have gotten a setup like this to work before, which was about a year ago but I have forgotten all of the commands/permissions which is why I am asking this question.

Output of getfacl

# file: www
# owner: root
# group: sftpaccess
user::---
group::---
group:sftp_read:r-x
group:sftp_read_write:rwx
mask::rwx
other::---

File trying to eddit

# file: Test.txt
# owner: sftp-alex
# group: sftp-alex
user::rw-
group::rw-
other::r--

Note: I can edit this file wheather I am in the sftp_read or the sftp_read_write which should not be the case I should only be able to read and write if I am in the sftp_read_write.

Thanks, Alex

  • use getfacl /mnt/www, what's the result? – FarazX Aug 7 '16 at 17:44
  • @FarazX I just edited the question with the output of getfacl /mnt/www – Alex Lowe Aug 7 '16 at 17:52
  • So that's working OK, getfacl the file you're trying to edit. – FarazX Aug 7 '16 at 17:57
  • @FarazX I just edited the question again with the output of getfacl /mnt/www/Test.txt. Make sure that you read the note underneath. – Alex Lowe Aug 7 '16 at 18:06
  • Run your command: setfacl -Rm g:sftp_read_write:rwX,g:sftp_read:rX /mnt/www again. What happens?? – FarazX Aug 7 '16 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.