I'd like to set up a chrooted SFTP server with upload only privileges.
Back in the day, I know I've done this with FTP on FreeBSD through the use of SETUID. All uploaded files were automatically owned by root with others having write only permission. I've learned that this method does not work on Linux (please correct me if I'm wrong).
I've also come across some FTP daemons allowing this by setting a umask for uploaded files and denying the use of chmod.
The closest I've come is the following:
- Set a umask in /etc/pam.d/sshd so that uploaded files are automatically created with write only permissions (eg. 0222). This is great, except OpenSSH allows the user to chmod any file so that he can than download any uplaoded file. I can't find a way to block the use of the chmod command - it seems to be an internal command and changing /bin/chmod to 0700 doesn't block users from running chmod..
- Use Gamin or a cronjob and write a script to automatically change ownership of files as they are created. This feels like a bit of a hack and relies on a script to be running correctly and feels like too much of a hack and a bit complex for what I need.
I'm running RHEL 6 with OpenSSH 5.3p1.
The point of this is to have one SFTP account that can be securely shared among 50 individuals to deliver files to the server rather than creating 50 SFTP accounts.