Do I have an option to forbid a user group or a sftpuser to set chmod +x?

The user shall be allowed to upload media files, but no php scripts to run for example.

  • If the user has access to your machine then the user is able to run chmod. You could use AppArmor to prevent a syscall that is triggered by chmod but then it might destabilize you system. You can try and set the umask to the uploading directory as it suits you. – Valentin Bajrami Jan 17 '13 at 8:22
  • 1
    PHP scripts don't need to have the executable bit set to be interpreted (in most cases). – faker Jan 17 '13 at 8:29

Yes : You can use a dedicated partition for sftpuser.

Once done, just disable executables on this partition ("noexec" in /etc/fstab).

This would look like :

/dev/examplevg/sftpuser        /home/sftpuser                   ext3    defaults,noexec 1 2

Note that also have to chroot sftpuser and since sftpuser just needs to upload php files, it is also a good idea to restrict the account to sftp : chroot + only sftp

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.