1

Im getting confused about permissions and sftp access in ubuntu.

I have a user who has access to the www folder :

<username>:www-data

I have set the following in sshd_config:

Subsystem sftp internal-sftp
Match group www-data
    X11Forwarding no
    ChrootDirectory /var/www
    AllowTcpForwarding no
    ForceCommand internal-sftp
Match
Match user <username>
    X11Forwarding no
    ChrootDirectory /var/www/<theirwebsite>
    AllowTcpForwarding no
    ForceCommand internal-sftp
Match

I have changed in sshd_config the location of authorized_keys (due to ubuntu encrypting the home folder)

AuthorizedKeysFile    /etc/ssh/%u/authorized_keys

I have chown -R username:www-data to all the www directories

And chmod them also to 755

Sometimes I can access through sftp, but then it wont let me edit files. Other times I cannot access at all.

I would really be grateful for any explanation or maybe to point to a help file somewhere.

Cheers

1 Answer 1

0

There are 2 different elements coming in to play:

  1. The ability to log into the server via ssh
  2. The permissions on the files.

The changes you have made to the SSH files all have to do with allowing access to the system, but the files will be owned by the user who SSH’d in.

You can read the files OK because the 755 permissions say “Owner can Read, Write and Execute,” anyone else can read and execute.

The hack (and less secure way) of solving the problem is to ensure the files are chmod 777 (IE anyone can read, delete and edit them).

A better way would be to put username into the www-data group (in /etc/groups) and give the files 775 permissions (ie owner and group can read, write and execute, everyone else can just read and execute)

I have not seen it before, but the sshd_config commands, assuming they work—and I have no reason to believe they won’t—limits the user to their own directory, and to only executing sftp. It can do nothing about changing the ownership of the files.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .