We have an nfs share which is mounted to /mnt/logs. User A is found within group sftp (in active directory) and can only sftp to /mnt/logs. In sshd_config we have:

Match Group sftpgr
  X11Forwarding no
  AllowTcpForwarding no
  ChrootDirectory %h
  ForceCommand internal-sftp

Directory /mnt/logs has the following permissions: drwxrwxr-x userX sftp

User A can sftp to /mnt/logs

Now we have another user, User B which can ssh to the host machine. Once we add User B to sftp group in active directory User B can no longer ssh.

How do we allow a group of users to sftp only to the /mnt/logs folder whilst allowing other users to ssh and access(and delete) files within /mnt/logs .

setfacl is not working with nfs.

  • Please provide your sshd_config from the server. (Add it to your question, and use {} to mark it as code.) I would imagine you've a directive in there that restricts access to users in the group sftp.
    – roaima
    Sep 23 at 7:42
  • 1
    (1) sftpgr vs sftp. Is this right? (2) What is the home directory for user A? and for user B? Sep 23 at 8:09
  • If you’re really using 2 different groups (sftpgr and sftp), I think it should work as expected if User A is member of both groups while User B is member of sftp only. Sep 25 at 21:12


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.