In my folder /var/www/storage/app/uploads/public I have a lot of subdirectories that are made by my website CMS and sftpupload script from a remote server.

Now the problem I'm facing arises from the sftp upload created directories.

improper permissions

The owner is sftpuser and there is no write permission on that directory for my www-data user to create a subdirectory.

This causes my www-data user php script to spew out

Backtrace from 'mkdir(): Permission denied' at /var/www/install-master/vendor/laravel/framework/src/Illuminate/Filesystem/Filesystem.php 336:

If I check the acl permissions on the parent directories from when I first set it to be group writable first, the topmost directory has correct acl permissions.

proper acl

But the second level, created by sftp doesn't have these

wrong acl

I found this question, but not really a useful answer except that sftp ignores acls.

I have tried setting the umask bit for sftp in /etc/ssh/sshd_config

changed umask in sshd_config

but even that didn't have an effect on the newly created directory. Still not writable for group.

How do I use sftp to give browse and create subdirectories permissions to newly created folders for owner and group, read and write permissions for owner and group, but not execute permissions on the files in those subdirectories?

Or should I use a different approach? As I understand it, sftp has only limited options on changing file permissions from the remote side, and acl are aparently ignored by openssh sftp.

So how do I get these proper permissions running on ubuntu 18.04 with an sftpuser?

1 Answer 1


I found the solution in bindfs. This allows the copying of uploaded folders to my target folder with the correct permissions.

I followed this tutorial https://www.talkerland.com/2018/08/20/howard/how-to-install-bindfs-on-ubuntu-18-04/

root@talkerland $ apt update
root@talkerland $ apt -y install bindfs
root@talkerland $ mkdir -p /home/gatekeeper/www/html
root@talkerland $ chown -Rf gatekeeper:gatekeeper /home/gatekeeper/www
root@talkerland $ chmod -Rf 770 /home/gatekeeper/www
root@talkerland $ nano /etc/fstab

Then on one line in /etc/fstab

bindfs#/var/www/html /home/gatekeeper/www/html fuse force-user=gatekeeper,force-group=gatekeeper,create-for-user=www-data,create-for-group=www-data,create-with-perms=god=rx:ud=rwx:gof=r:uf=rw,chgrp-ignore,chown-ignore,chmod-ignore 0 0

to get bindfs up and running, I just had a few changes in the fstab entries to get the permissions I wanted, which is group writable as well, by changing god to od and ud to gud. Here o stands for other, g stands for group, and u stands for user and f stands for file and d stands for directory.

bindfs#/var/www/html /sftp/sftpuser/app fuse force-user=sftpuser,force-group=sftpuser,create-for-user=www-data,create-for-group=www-data,create-with-perms=od=rx:gud=rwx:of=r:ugf=rw,chgrp-ignore,chown-ignore,chmod-ignore 0 0

This way I now have a pretty fine tuned method of uploading these remote files, with proper permissions. The only shame is that I have duplicate content now, but that's a drawback I'm sort of ok with for proper permission control.

Proper permissions

  • Hi ... Just wondering, why do you say you have duplicate content ? Content written into folders that are mapped to another location will have that content in that folder only ? right ? Pls correct me if i am wrong ?
    – MarcoZen
    Commented Jul 8, 2021 at 19:38
  • Because my sftp user is a user with very limited permissions. You don't want the auto accept uploaded have access to sensations files like the www directory. By using bind fs you can mount the directory as www-data so sftp has its own concern, www-datahas its own concern, but both work Commented Jul 8, 2021 at 22:02
  • Noted. I just dont understand why you have duplicate content. Duplicate content -> FIle A in dirA ..and File A is also in dirB ? Is this happening to you ?
    – MarcoZen
    Commented Jul 9, 2021 at 7:06
  • No, bind fs just mounts the given folder to the target folder. Basically two entries in the filetable used by the OS reference the same directories, they just get seperate permission entries. Commented Jul 12, 2021 at 7:16
  • 1
    :) Hehhehehehe ...
    – MarcoZen
    Commented Jul 13, 2021 at 17:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .