Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There is an FTP user called 'A1', home dir: '/home/A1'. A1 can connect to FTP with no problems. There is two files in '/home/A1': 'abc.txt' and 'def.txt'.

Permission of 'abc.txt': 440; Permission of 'def.txt': 660

I want '/home/A1' to be shared with two more users called 'A2' and 'A3', so their home directory is '/home/A1' and they are added to the group 'A1'. Now they also can connect to FTP with no problems.

I want 'A2' and 'A3' to only be able to modify or delete 'def.txt' but not be able to modify or delete 'abc.txt'. Unfortunately now they can modify or delete both two files.

How could I set up this config? Thanks for your help in advance!

UPDATE #1

As requested here's the output for the following command:

$ ls -lR /home/A*
/home/A1:
total 14912
drwxr----- .
-r--r--r-- 1 A1 A1 467 Aug 11 16:16 abc.txt
-rw-rw---- 1 A1 A1 15264286 Aug 11 16:18 def.txt 

UPDATE #2

I created two new users because I failed everything as possible with A1 and A2 (tried B also...), so here is the setup:

$ useradd C1 -m
$ passwd C1
$ useradd C2 -d /home/C1 -g C1
$ passwd C2

chmod chown etc...

$ ls -laR /home/C1
/home/C1:
total 8
drw-rw----  2 C1   C1   4096 Aug 14 00:39 .
drwxr-xr-x 35 root root 4096 Aug 14 00:37 ..
-r--r-----  1 C1   C1      0 Aug 14 00:39 abc.txt
-rw-rw----  1 C1   C1      0 Aug 14 00:39 def.txt

Remember: the aim is to not allow C2 to del/mod abc.txt but he could del/mod def.txt

$ su C2
$ ls -la
ls: cannot open directory .: Permission denied

What the hell? Group permission is readable for C2 so why "Permission denied"?

share|improve this question

1 Answer 1

I don't think A2 can modify abc.txt but he can delete it because the directory (probably) has group permissions rwx and deleting the files is equivalent to modifying/writing the directory structure.

So, probably

chmod g-w /home/A1

will solve that.

However you only gave an example and didn't specify an abstract permission scheme like "A2 should not be able to modify A1's files" or the like, which should be the base of all reflections about securing those directories.


/home/A1# ls -la
drwxr-x---  2 A1   A1   4096 Aug 13 20:10 .
drwxrwsr-x 10 root root 4096 Aug 13 20:04 ..
-r--r--r--  1 A1   A1      0 Aug 13 20:04 abc.txt
-rw-rw----  1 A1   A1      0 Aug 13 20:12 def.txt

mark5:/home/A1# su A2
mark5:/home/A1$ id
uid=20002(A2) gid=20002(A1) groups=20002(A1)
mark5:/home/A1$ rm abc.txt
rm: remove write-protected regular empty file `abc.txt'? y
rm: cannot remove `abc.txt': Permission denied
mark5:/home/A1$ echo 123 > abc.txt
sh: abc.txt: Permission denied
mark5:/home/A1$ echo 123 > def.txt
mark5:/home/A1$

No idea why this works on your platform. What if you try on the console? Are you actually becoming user A2 when you log in using FTP?

share|improve this answer
    
Thanks for the answer! It is a good idea to modify the directory's permission, but unfortunately it did not work. My aim is to have there one file that can be only readable so they could not delete it or modify and it is 'abc.txt'. However, they could be able to delete or modify all the others (for instance 'def.txt' etc...). –  user2302838 Aug 12 '13 at 16:55
    
Please show ls -lR /home/A* –  Marki Aug 12 '13 at 19:35
    
/home/A1:total 14912 -r--r--r-- 1 A1 A1 467 Aug 11 16:16 abc.txt -rw-rw---- 1 A1 A1 15264286 Aug 11 16:18 def.txt and /home/A1 is drwxr----- (ps: sorry, but serverfault cannot handle new lines in comments if I am not mistaken) –  user2302838 Aug 12 '13 at 20:34
    
See my example in the edited answer. BTW your directory 444 not 440 as you describe in the text, but that doesn't matter here I guess. –  Marki Aug 13 '13 at 18:17
    
Check out the update#2. Now I am totally confused about this permission problem. –  user2302838 Aug 13 '13 at 22:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.