0

I'm having some issues with users read/write permissions on home directories.

I've an user who is allowed to upload data through ftp (let's say ftp_user) and this user has it's own /home/ftp_user directory.

I need to access /home/ftp_user from other standard users (not everyone) in read-only mode, in order to see and copy uploaded content if needed.

I tried with a chgrp and chmod (644) on /home/ftp_user/, but in this way ftp_user lost the ownership and read/write permissions. I could set a 777 but I don't think it's the best solution and I would like to grant read access only to some users.

Any suggestion?

Thanks!

more: the perfect solution would be to share only a specific directory, like /home/ftp_user/shared. I'm running Ubuntu 16.04 if it matters.

  • Please edit your question and add the output of the following command: ls -ld ~ftp_user – Andy Dalton Jan 19 '18 at 16:06
  • Look at using access control lists – Raman Sailopal Jan 19 '18 at 16:09
  • 2
    Add the users that should have permission to the ftp_user group, and set the group permissions appropriately. The group permissions are the second rwx in the file mode (the second digit of the octal mode). If you want tighter control, create a new group and chown that directory to that group and add users to that group. – doug65536 Jan 19 '18 at 16:10
1

Assuming everyone who is supposed to have access is a member of the group ftp_user:

# get everything in a defined state
chown -R ftp_user:ftp_user /home/ftp_user
chmod -R u=rwX,g=,o= /home/ftp_user
# allow the group to access contents of the home dir (no content listing)
chmod 710 /home/ftp_user
# give the group read access to everything
chmod -R u=rwX,g=r,o= /home/ftp_user/shared
# give the group access to directories and give newly created (`cp`, not `mv`) objects the same group
find /home/ftp_user/shared -type d -exec chmod g=rxs {} +

This does not prevent access to files or directories which are later created in /home/ftp_user with read / execute permission for more than the owner. This could be done with default ACLs for /home/ftp_user:

setfacl -d -m u::rwx,g::-,o:- /home/ftp_user
  • You should explain the purpose of your commands. – Centimane Jan 19 '18 at 16:48
  • @Centimane There was even room for improvement on the code side. – Hauke Laging Jan 20 '18 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.