0

In my folder /var/www/storage/app/uploads/public I have a lot of subdirectories that are made by my website CMS and sftpupload script from a remote server.

Now the problem I'm facing arises from the sftp upload created directories.

improper permissions

The owner is sftpuser and there is no write permission on that directory for my www-data user to create a subdirectory.

This causes my www-data user php script to spew out

Backtrace from 'mkdir(): Permission denied' at /var/www/install-master/vendor/laravel/framework/src/Illuminate/Filesystem/Filesystem.php 336:

If I check the acl permissions on the parent directories from when I first set it to be group writable first, the topmost directory has correct acl permissions.

proper acl

But the second level, created by sftp doesn't have these

wrong acl

I found this question, but not really a useful answer except that sftp ignores acls.

I have tried setting the umask bit for sftp in /etc/ssh/sshd_config

changed umask in sshd_config

but even that didn't have an effect on the newly created directory. Still not writable for group.

How do I use sftp to give browse and create subdirectories permissions to newly created folders for owner and group, read and write permissions for owner and group, but not execute permissions on the files in those subdirectories?

Or should I use a different approach? As I understand it, sftp has only limited options on changing file permissions from the remote side, and acl are aparently ignored by openssh sftp.

So how do I get these proper permissions running on ubuntu 18.04 with an sftpuser?

0

I found the solution in bindfs. This allows the copying of uploaded folders to my target folder with the correct permissions.

I followed this tutorial https://www.talkerland.com/2018/08/20/howard/how-to-install-bindfs-on-ubuntu-18-04/

root@talkerland $ apt update
root@talkerland $ apt -y install bindfs
root@talkerland $ mkdir -p /home/gatekeeper/www/html
root@talkerland $ chown -Rf gatekeeper:gatekeeper /home/gatekeeper/www
root@talkerland $ chmod -Rf 770 /home/gatekeeper/www
root@talkerland $ nano /etc/fstab

Then on one line in /etc/fstab

bindfs#/var/www/html /home/gatekeeper/www/html fuse force-user=gatekeeper,force-group=gatekeeper,create-for-user=www-data,create-for-group=www-data,create-with-perms=god=rx:ud=rwx:gof=r:uf=rw,chgrp-ignore,chown-ignore,chmod-ignore 0 0

to get bindfs up and running, I just had a few changes in the fstab entries to get the permissions I wanted, which is group writable as well, by changing god to od and ud to gud. Here o stands for other, g stands for group, and u stands for user and f stands for file and d stands for directory.

bindfs#/var/www/html /sftp/sftpuser/app fuse force-user=sftpuser,force-group=sftpuser,create-for-user=www-data,create-for-group=www-data,create-with-perms=od=rx:gud=rwx:of=r:ugf=rw,chgrp-ignore,chown-ignore,chmod-ignore 0 0

This way I now have a pretty fine tuned method of uploading these remote files, with proper permissions. The only shame is that I have duplicate content now, but that's a drawback I'm sort of ok with for proper permission control.

Proper permissions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.