SFTP Only Users Unable to Delete/Edit Files They Create

Question

I modified /etc/ssh/sshd_config with these lines to support an sftp user group that isn't able to SSH.

    Subsystem sftp internal-sftp -l VERBOSE
    Match Group sftpusers
    X11Forwarding no
    AllowTcpForwarding no
    ChrootDirectory %h
    ForceCommand internal-sftp

I create a user in the sftpusers group, with ssh capabilities restricted like so:

useradd -g sftpusers -s /sbin/nologin <username>

The problem is, even if I use the following command to give recursive permissions to all users and groups in their home folder, when they create a new file, they immediately lose access because the default file permissions are not what I recursively set the file structure to:

chmod -R 777 /home/<username>/

I've tried giving the user ownership of the file structure, but that makes it so the user can no longer sftp (I believe because of the ChrootDirectory option, making it so their home directory and all sub components must be owned by root). I'd really like a solution that allows a user to only be able to sftp (no ssh) while having no access to the majority of files in their home directory, unless specifically given access or created by them.

Answer 1

You might get what you are looking for with the following steps:

1. recursively giving only owners access to all files and folders in the user directory (only root or file owner will have access to everything):

   chmod -R 700 /home/<user_dir>/

2. Give users and groups access to the chroot so they can list files when using sftp (after running this your sftp user will be able to list the contents in the user directory):

   chmod 755 /home/<user_dir>/

3. Give users ownership of a file or recursive ownership over a directory you want them to have full access to:

   chown /home/<user_dir>/file

or

chown -R /home/<user_dir>/dir

You can repeat steps 2 and 3 as you see fit to get them access wherever they need. Hope this helps!