Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm attempting to setup SFTP (OpenSSH 6.1 internal-sftp) so that a group of users(sftpusers) can access my server specifically to work on development of my website:

 Match Group sftpusers
        Chrootdirectory /srv/sftp/shared
        AllowTCPForwarding no
        X11Forwarding no
        ForceCommand internal-sftp

I have created the chroot (/srv/sftp/shared) owned by root. Apache virtual directories are pointing to folders in /srv/sftp/shared/www. This folder is owned by www-data as expected:

drwxrwxr-x 5 www-data www-data 4096 Oct 13 20:39 /srv/sftp/shared/www
drwxr-x--- 3 root sftpusers 4096 Oct 13 19:41 /srv/sftp/shared

Apache error is:

[Sun Oct 13 22:04:15 2013] [crit] [client 117.62.133.161] (13)Permission denied: /srv/sftp/shared/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable Verified virtual directories are set to shared/www, not shared

I am able to access all of these files via SFTP. My problem is that when attempting to access my sites from a web browser now I'm getting "Permission Denied" errors which I assume comes from having these folders in the chroot. How can I allow Apache access to this chroot?

share|improve this question
    
Can you list the permissions on the folder and parent? (ls -al /srv/sftp/shared; ls -al /src/sftp/shared/www). Any errors in Apache logs? –  Andy Shinn Oct 14 '13 at 2:08
    
drwxrwxr-x 5 www-data www-data 4096 Oct 13 20:39 /srv/sftp/shared/www drwxr-x--- 3 root sftpusers 4096 Oct 13 19:41 /srv/sftp/shared Apache error is: [Sun Oct 13 22:04:15 2013] [crit] [client 117.62.133.161] (13)Permission denied: /srv/sftp/shared/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable Verified virtual directories are set to shared/www, not shared –  Ken J Oct 14 '13 at 2:20

1 Answer 1

up vote 0 down vote accepted

See http://wiki.apache.org/httpd/13PermissionDenied, particularly the bold statement that says search the directory containing those files, along with all parent directories up to the root of the filesystem. Apache needs to be able to read / execute on the parent directories of the DocumentRoot. Try making sure that others have +rx permissions on all the folders:

chmod -R o+rX /srv
share|improve this answer
    
This worked great, thanks! My concern with playing with the permissions of the directories was that I was afraid it would break the chroot but this did NOT. I am still able to SFTP and now my sites are up. Thanks again! –  Ken J Oct 14 '13 at 9:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.