I'm running Ubuntu 12.04.1 LAMP server and I'm trying to get a user read write FTP access to /var/www.
First I've installed vsftpd and set write_enable=YES and chroot_local_user=YES in vsftpd.conf then I've added the following paragraph to /etc/ssh/sshd_config:
Subsystem sftp internal-sftp Match group sftponly ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no
As well as commenting out:
#Subsystem sftp /usr/lib/openssh/sftp-server
After this I've restarted SSH and VSFTPD then set file permissions as follows on /var/www:
chown -R root /var/www chgrp -R www-data /var/www
The first two set the user and group owner
chmod -R 775 /var/www
Then these define permissions (user and group have read, write and execute)
Then I create user and add them to the sftponly and www-data groups
adduser test usermod -aG www-data test usermod -aG www-data test
And set their home directory to /var/www
usermod -d /var/www test
Once this is done I can't connect with SFTP unless I do the following:
chmod g-w /var/www
Which means that www-data (and also my user) can't write to the www folder, but can write to all subsequent folders which isn't enough.
I can't change the user owner of the www folder either as that also prevents a successful connection with SFTP.
I just want to know why I can't connect with SFTP is the group has write access but can if it doesn't?