Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set up an sftpusers group on my CentOS box and am using the internal SFTP service to allow users to upload files to a chroot-configured directory.

The owner of the directory is root, and its group is sftpusers, and they have read/write permission on it which allows them to upload files via SFTP.

What I'd like is to disallow the deletion and reading of remote files straight after they upload them, so that anything they upload is stuck there permanently, and other people using the same login can't read or delete each others' files.

So my questions:

1) Is there a way to do this using simple permissions?

2) Is there a way to set the "default permissions" of any files uploaded by a member of sftpusers group? So that once they upload a file it is automatically un-readable or whatever?

3) Is there otherwise a way to do this which doesn't involve a cron script running every minute or whatever to change the permissions?

4) Is there a way to run a script (or otherwise trigger some event) straight after a file finishes uploading? Some kind of "onFileFinishUpload" event type thing I can hook into somehow?


share|improve this question
up vote 1 down vote accepted

Apologies i do not have sufficent reputation here to post all the links inline. I have prepared a gist which preserves them:

  1. There's no way to achieve this with simple permissions. Due to OpenSSH's sftp-server you won't be able to implement the full requirements list but depending on the filesystem the files are being uploaded to, you can leverage [attributes] and [ACLs] to achieve some of your requirements.

  2. Yes, the [sftp-server takes a -u parameter] (you can set this in your [sshd_config] on the Subsystem sftp line) which sets the umask for all uploads.

  3. Yes, you can make use of inotify, one way may be with the [incron] tool although there are many ways to use inotify. Inotify allows you to have the kernel notify a userspace program on a filesystem event you identify, e.g. adding a file to a directory. You can then run a command on this event.

    (3 Part 2) An alternative approach that may not be suitable for you is to use something like vsftpd with SSL protected FTP. This allows for encrypted FTP but because vsftpd is a full featured FTP server it provides simple configuration (see the [chown_uploads parameter] in vsftpd.conf) to match your exact needs.

  4. Yes, via the inotify subsystem, you could register a watch for the [IN_CLOSE_WRITE] event.

share|improve this answer
Wonderful and informative response; thank you. I will explore the options but this certainly gives me more than enough to go on with. I hope this post serves future users well, too. Cheers! – Robert Hawkins Sep 1 '12 at 23:41
As an update, I noticed that the internal-sftp subsystem doesn't seem to support the -u parameter. I'm using internal-sftp because this was reportedly simpler to set up with an sftp-only chroot configuration. I saw this patch which adds a -u option for internal-sftp... but do you think it would be difficult to switch to /openssh/sftp-server? – Robert Hawkins Sep 2 '12 at 0:06
Specifying user for ftp (at least in vsftpd) I believe ONLY works for anonymous uploads, not for uploads by a system user. – Buttle Butkus Nov 15 '12 at 6:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .