2

I have a server that multiple users access via sftp. They do not have ssh access and they are contained to their home directory by setting the ChrootDirectory /home/%u in the /etc/ssh/sshd_config file. I want one user to be able to access an entire directory containing files uploaded by another user. I tried creating a symlink: ln -s /home/user2/files /home/user1/other_files but when user1 logs in, they can see the link but not navigate to it. If I ssh into the box, I can use the other_files symlink to see the uploaded files, but the sftp users cannot (they get a permisisons error when accessing).

Can I allow these users to share files automatically while still containing them to their home directory? I know the symlink points to a path outside of their directory, which I believe is causing the permission issue. I can't manually move the files - the uploads are automatic and occur frequently, so I need user1 to be able to see the files as soon as they're uploaded. If I recreate the users with the same home directory and adjust the permissions of their respective upload directorys, would that allow user 1 to get the files? Ideally, user 2 shouldn't have access to any of user 1's files, but if that has to happen, it will still work for me.

5
  • 1
    Have you tried a hard link instead of a soft link?
    – EEAA
    Oct 14, 2010 at 20:01
  • @ErikA - I need user1 to have access to an entire directory of files, so I can't create a hard link. Oct 14, 2010 at 20:09
  • Oh right. Can't hard link to a directory. However, you can use cp -al to copy an entire directory tree as hard links. Oct 14, 2010 at 20:20
  • @Steven Monai - The cp -al works, but only for the files that currently exist. If user 2 uploads another file after the command has been run, it doesn't show in the copied folder for user 1. Is there no way to automatically update the folder as new items are uploaded? Oct 15, 2010 at 17:16
  • RedGrittyBrick's answer mentions inotify. You could use some technology based on inotify (such as, perhaps, incron) to monitor changes in specific directories and automate the creation/deletion of hard links between chrooted directories. Oct 15, 2010 at 17:57

1 Answer 1

3

Some random untested ideas:

Have you tried chrooting user2 to a subdirectory of the directory to which user1 is chrooted?

If they don't have SSH logins or use other services, the overlap probably won't cause any problems :-)

Perhaps you can also use the sticky bit to prevent user1 harming user2's chrooting environment?

Finally, if you must continuously duplicate files between two separate chrooted home directories, have a look at inotify. There's also inotify-tools package that looks handy

2
  • +1 for mention of inotify. Oct 15, 2010 at 17:56
  • I chrooted user2 to a subdirectory of user1 - user2 couldn't access any other files, and user1 had access to everything with the proper permissions. I didn't have to configure inotify. Oct 19, 2010 at 4:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .