Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Do I have an option to forbid a user group or a sftpuser to set chmod +x?

The user shall be allowed to upload media files, but no php scripts to run for example.

share|improve this question
If the user has access to your machine then the user is able to run chmod. You could use AppArmor to prevent a syscall that is triggered by chmod but then it might destabilize you system. You can try and set the umask to the uploading directory as it suits you. – val0x00ff Jan 17 '13 at 8:22
PHP scripts don't need to have the executable bit set to be interpreted (in most cases). – faker Jan 17 '13 at 8:29

Yes : You can use a dedicated partition for sftpuser.

Once done, just disable executables on this partition ("noexec" in /etc/fstab).

This would look like :

/dev/examplevg/sftpuser        /home/sftpuser                   ext3    defaults,noexec 1 2

Note that also have to chroot sftpuser and since sftpuser just needs to upload php files, it is also a good idea to restrict the account to sftp : chroot + only sftp

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.