Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm running Ubuntu 12.04.1 LAMP server and I'm trying to get a user read write FTP access to /var/www.

First I've installed vsftpd and set write_enable=YES and chroot_local_user=YES in vsftpd.conf then I've added the following paragraph to /etc/ssh/sshd_config:

Subsystem sftp internal-sftp

Match group sftponly
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no

As well as commenting out:

#Subsystem sftp /usr/lib/openssh/sftp-server

After this I've restarted SSH and VSFTPD then set file permissions as follows on /var/www:

chown -R root /var/www
chgrp -R www-data /var/www

The first two set the user and group owner

chmod -R 775 /var/www

Then these define permissions (user and group have read, write and execute)

Then I create user and add them to the sftponly and www-data groups

adduser test
usermod -aG www-data test
usermod -aG www-data test

And set their home directory to /var/www

usermod -d /var/www test

Once this is done I can't connect with SFTP unless I do the following:

chmod g-w /var/www

Which means that www-data (and also my user) can't write to the www folder, but can write to all subsequent folders which isn't enough.

I can't change the user owner of the www folder either as that also prevents a successful connection with SFTP.

I just want to know why I can't connect with SFTP is the group has write access but can if it doesn't?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I have looked over the net, and have found some interesting thing: http://www.thegeekstuff.com/2012/03/chroot-sftp-setup/

it says that your users homedir should be: / or you should have some symlinks in /var/www dir something like:

cd /var/www ; ln -s var . ; ln -s www .

because, user is chrooted, and searching for its homedir: /var/www in /var/www

hope it will help you.

share|improve this answer
    
If I set Chroot to /var then the home directory to /www I can connect, but the user can also browse the rest of /var which isn't desirable. I'll see if I can get it working with symbolic links. –  Josh Mitchell Jan 29 '13 at 11:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.