Linux: prevent SFTP users from deleting FTP'd files even straight after they upload them?

Question

I've set up an sftpusers group on my CentOS box and am using the internal SFTP service to allow users to upload files to a chroot-configured directory.

The owner of the directory is root, and its group is sftpusers, and they have read/write permission on it which allows them to upload files via SFTP.

What I'd like is to disallow the deletion and reading of remote files straight after they upload them, so that anything they upload is stuck there permanently, and other people using the same login can't read or delete each others' files.

So my questions:

1) Is there a way to do this using simple permissions?

2) Is there a way to set the "default permissions" of any files uploaded by a member of sftpusers group? So that once they upload a file it is automatically un-readable or whatever?

3) Is there otherwise a way to do this which doesn't involve a cron script running every minute or whatever to change the permissions?

4) Is there a way to run a script (or otherwise trigger some event) straight after a file finishes uploading? Some kind of "onFileFinishUpload" event type thing I can hook into somehow?

Cheers!

Answer 1

Apologies i do not have sufficent reputation here to post all the links inline. I have prepared a gist which preserves them: https://gist.github.com/3590779

1. There's no way to achieve this with simple permissions. Due to OpenSSH's sftp-server you won't be able to implement the full requirements list but depending on the filesystem the files are being uploaded to, you can leverage [attributes] and [ACLs] to achieve some of your requirements.

2. Yes, the [sftp-server takes a -u parameter] (you can set this in your [sshd_config] on the Subsystem sftp line) which sets the umask for all uploads.

3. Yes, you can make use of inotify, one way may be with the [incron] tool although there are many ways to use inotify. Inotify allows you to have the kernel notify a userspace program on a filesystem event you identify, e.g. adding a file to a directory. You can then run a command on this event.

   (3 Part 2) An alternative approach that may not be suitable for you is to use something like vsftpd with SSL protected FTP. This allows for encrypted FTP but because vsftpd is a full featured FTP server it provides simple configuration (see the [chown_uploads parameter] in vsftpd.conf) to match your exact needs.

4. Yes, via the inotify subsystem, you could register a watch for the [IN_CLOSE_WRITE] event.