1

I'm configuring GNU/Linux users as users for a vsftpd FTP server and I have the following safety constraints:

  • User foo can read and write in his home directory.
  • User bar can read and write in his home directory and in foo's.
  • User baz can read and write in his and foo's and read in bar's home directory.
  • All users must not read any other directory (users are in a chroot jail by the vsftp.conf).

How would I achieve something like this?

4
  • 1
    You can't do that as described. Which bits are negotiable? Nov 26, 2019 at 8:06
  • could you explain why this can't be done (I believe you, just to understand it). The most important part would be, that the users can only access some directories. Nov 26, 2019 at 8:14
  • If you put the users each in their own chroot they can't access anything else. Period. If that's negotiable then the rest can be easily solved. Nov 26, 2019 at 8:19
  • ok, I see. Is there another method to make sure the users can acces the directories as described above but nothing else? Nov 26, 2019 at 8:50

2 Answers 2

3

I would suggest to use ACL (access control lists) in this case. It allows much more finegrained control than just user/group permissions.

See https://linuxconfig.org/how-to-manage-acls-on-linux for an introduction.

0

Generally speaking, either you open the rights of the specific folders like 660

Either each of them belong to a specific group that can access to specific folders example : if folder2 belongs to apache you can do a usermod -a -G apache bar to allow him to access to this folder but at this moment you have to double-check if it's not too much permissive

Maybe you can do intermediary groups to access to some folders, but I'm not sure that it's a good idea to manipulate the rights of what is in /home/ Better to use a network share mount point or a shared folder somewhere else in the filesystem, in my opinion

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .