3

I am running CentOS, where I have users in a chroot SFTP setup. They are chrooted to their home directories. These users belong to the group 'sftponlyusers'. I allow these users to upload to a directory within their called 'upload' The current ACL permissions for the 'upload' directory are:

getfacl upload
# file: upload
# owner: root
# group: root
# user: rwx
user:sftpuser1:-wx
group::r-x
group:sftpfileadmins:rwx
mask::rwx
other::---

I have a few users in another group called 'sftpfileadmins'. These are users that will be able to move/copy/archive the files that the sftponlyusers place in the upload directory.

sftpuser1 is able to login and place files in their /user/upload directory. However when they do so they are always the owner of the file, and the file always has the following permissions:

getfacl file.txt
# file: file.txt
# owner: sftpuser1
# group: sftponlyusers
user::rw-
group::---
other::---

This means that the sftpfileadmins cannot perform any operation on the file (they can't move, copy, or read it).

I need help to figure out the correct combination of permissions that would allow sftpuser1 to only write to the directory, while users in the group sftpfileadmins would be able to both read and write.

2

This problem is resolved with the latest update (openssh-6.6.1p1-32.el7_3). This is known bug.

Cross-duplicate post discussing the same issue on SuperUser.

  • Do you know if there are any issues updating to this version of openssh using the default centos7 repo? – cy10n Feb 16 '17 at 15:47
  • This is bugfix release so it fixes this problem and to my best understanding should not break anything else. – Jakuje Feb 16 '17 at 15:50
  • Do you happen to know if adding a umask attribute in sshd_config would be a workaround for the issue? Thanks for all the assistance! – cy10n Feb 16 '17 at 16:15
  • No. The problem is in the group initialization, which was wrong. Umask does affect only resulting permissions on the created files. – Jakuje Feb 16 '17 at 16:18
  • I think that was my point though. If I use a umask to set the resulting file permissions on the files that the sftpuser1 is uploading, say 755, then I should be able to copy/move/archive them with the account belonging to sftpfileadmins group. I apologize if this does not make sense, haven't been working with linux for very long. – cy10n Feb 16 '17 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.