Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Edit: in my case virtual_use_local_privs=TRUE did the trick.

i'm trying to force newly created files and directories inside foo/ directory to be owned by nginx user and to set the right permissions so nginx group users can execute and modify them if needed.

The whole thing is i've just configured vsftpd service where my virtual users act as vsftpd user, where vsftpd is a real user with no shell.

After login, each user is chrooted on a directory owned by user vsftpd and group nginx. To accomplish that i created the chroot directory:

mkdir chroot/ 

and then gave the default permissions:

chown -R vsftpd:nginx chroot/

and then enabled SGUID:

chmod -R g+s chroot/ 

Right here, when a vsftpd user creates a directory default permissions are vsftpd:nginx but default permissions for files are nginx:nginx which is not what i want.

Then, as i need nginx user's group to run and modify files if need i setted umask '0022' through vsftpd config but i think i'm going in the wrong way. Can anyone point me to the right direction?

Thanks in advanced!

Edit:

The setfacl command helped a lot, but i'm still having issues with umask.

I run setfacl -R -m d:u:vsftpd:rwx,d:g:nginx:rwx,d:m:rx,d:o::r chroot/ where getfacl chroot/ returns:

# owner: vsftpd
# group: nginx
# flags: -s-
user::rwx
group::rwx
mask::rwx
other::r--
default:user::rwx
default:user:vsftpd:rwx         #effective:r-x
default:group::rwx              #effective:r-x
default:group:nginx:rwx         #effective:r-x
default:mask::r-x
default:other::r--

but uploading new files leaves the following permissions -rw-------+ 1 vsftpd nginx 25 feb 7 13:14 info.php

Note umask setting on vsftpd.conf is set to 1002

Where am i going wrong? Thanks a lot!

share|improve this question
    
Try uploading with different ftp clients (eg filezilla for windows) –  coincoin Feb 7 '13 at 12:30

1 Answer 1

You will probably have to use acl's to get the user to always be set to nginx. You would mount the filesystem with acl option, then use

setfacl -m d:u:nginx:rwx,d:g:nginx:rw chroot

(or rw if you don't need executable). Then all files created in the dir will have additional perms giving nginx ownership (even if the primary owner, that shown when ls is used, is a different user).

share|improve this answer
    
Hi, thanks a lot! The setfacl command helped a lot, but i'm still having issues with umask. I run setfacl -R -m d:u:vsftpd:rwx,d:g:nginx:rwx,d:m:rx,d:o::r chroot/ but uploading new files leaves the following permissions -rw-------+ 1 vsftpd nginx 25 feb 7 13:14 info.php Note umask on vsftpd.conf is set to 1002 –  user846226 Feb 7 '13 at 12:16
    
Remember, umask is the reverse of 777, so if your umask is set to 002, then the perms of a new file will be 775. I don't see anything anywhere that will set any other bits than read, write, and execute. Your result seems to be consistent. If you run getfacl on the file, you will see that it got the default acl applied to it. –  lsd Feb 7 '13 at 13:07
    
Thanks, i see umask i set in the right way but as you can see file uploads doesn't seem to obey the default umask, isn't it? Must be something wrong somewhere –  user846226 Feb 7 '13 at 13:16
    
No your uploaded file looks fine to me. Correct perms for the umask, and if you do a getfacl on the file, you will see the correct perms. umask and default acls are two different things. –  lsd Feb 7 '13 at 13:37
    
Finally virtual_use_local_privs=TRUE did the trick, now vsftpd respects acl settings. Thanks a lot lsd! :D –  user846226 Feb 7 '13 at 14:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.