1. sftp users need to be able to maintain their account's websites via sftp. I have created a "sftponly" group for them.

  2. Apache (user: www-data) needs to be able to read, write and execute in these users' "www" folders. For instance, Wordpress auto-update feature should work without specifying ftp credentials.

The file structure I follow is like this:


I managed to make either requirement work, but not the two alongside.

Here is the process I follow to create a new user at the moment:

adduser <username>
usermod -G sftponly <username>
chown root:root /home/<username>
chmod 755 /home/<username>
cd /home/<username>
mkdir www
chown -R <username>:sftponly *
chown -R www-data:www-data /home/<username>/www
chmod -R 770 /home/<username>/www

How can I meet both requirements?

System: Ubuntu 14.04, Apache 2.4.7


I believe that the easiest way to meet both requirements would probably be to utilize Access Control Lists:

ACLs -- Arch-Wiki

Just simply add another group like so:

setfacl -mR "g:sftponly:rw" /home/<username>/www

If you can't, or do not want to use ACL's I would suggest looking at this documentation:


SCPOnly is a special shell that can work with chroot jails and PAM to more securely allow users remote access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.