1

I have a RedHat server with SFTP enabled and a few accounts, this server is currently being accessed by an application to read the user's respective files, they do not have Write access. The server is also not on the same domain/network, but ports/firewalls are configured for access.

The current setup includes the following directory structure and permissions:

/sftp / users / user1 / data / FilesAndFolders
sftp: 755 root:root
users: 755 root:root
user1: 754 root:user1
subfolders: 554 user1:user1

The users are set up with CHROOT via the below:

Match Group user1
  x11Forwarding no
  AllowTcpForwarding no
  ChrootDirectory /sftp/users/user1
  ForceCommand internal-sftp

This allows the users access to their respective folders with Read-Only access.

My issue is that I cannot seem to create a "SFTP Manager" type of account, that would have Read/Write access to the whole SFTP folder, AND be CHROOT'd to the SFTP folder (or the Data folder, either is OK).

The issue appears to be how the CHROOT is set up, with the current setup you will encounter errors when connecting via FileZilla if the CHROOT is set to the "users" folder or any of the subfolders, it has to be the user1 folder.

Any suggestions or pointers would be greatly appreciated (I feel like i've missed something obvious), i'm also open to alternatives that allow the following:

  • Users are locked to only seeing their files with Read-Only.
  • A manager account that has Read/Write to all the users folders.
  • Can be set up within a Linux distro and isn't overly "hackey" to access via C# (hackey eg Windows shared folder mappings).
  • Is moderately secure/uses username and password to access.

EDIT: I believe this is a very similar issue to this one which is unsolved.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.