I am creating an sftp server in GKE using atmoz/sftp Dockerfile. I am also using gscfuse to mount one Cloud Storage Bucket as the /home directory of the container.

I am creating two sftp users user1 and admin with SSH keys. I have managed to created the users after mounting the bucket and checking the content of the bucket I see two directories have been created called user1 and admin.

I have used the following command to mount the bucket as the /home of the container:

gcsfuse --implicit-dirs -o nonempty,allow_other \
  --uid=0 --gid=100  \
  -file-mode=755 -dir-mode=755 \
  gcs-bucket-name /home

I am able to login with both the sftp users (user1 and admin) using the following command:

sftp -i /path/to/privateKeyFile [username]@[serviceIp]

The issue here is, none of the users have write-access to their home/$user directory. Of course, this is supposed to happen because I have -file-mode=755 -dir-mode=755 (allow the only user with id=0 (root) to write, and all the other users (group and other users) have read only access. Along with --uid=0 --gid=100 (files and directories owned by root:users). Both user1 and admin are parts of users group (gid=100).

I am also using the following command to create a link to user1/data directory with admin/data/user1 directory with the following command:

bindmount /home/user1/data /home/admin/data/user1

When I sftp log in using admin and do ls data/user1 I am able to see the content present inside the directory. However, neither the user1 nor the admin has write-access to data/user1. What changes to make so that admin has the write-access to all the other $user/data directory it is bindmount to and the other users have write-access to there own directory (/home/$user/data).

I tried doing -file-mode=755 -dir-mode=775 but it fails because (I think) home needs to be owned by the root user with 755 permissions. I also tried -file-mode=775 -dir-mode=755 but this also fails while login saying Authentication refused: bad ownership or modes for file /home/admin/.ssh/authorized_keys. I suspect this happens because .ssh should be owned with 755 permission as well. I am really stuck in this chicken and egg situation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.