force group assignment in chrooted sftp environment

Question

I've got the following setting:

There are several users /home/user1, /home/user2, and so on. Additionally there is a user /home/sftp-all. The folder /home/sftp-all/shared is mounted in every other users /home directory, e.g. /home/user1/shared. All users user1,user2,...,sftp-all are members of a group called 'sharegroup'.

Now the problem is, if one of these users (user1,...) writes into that folder, the new file is owned by the user and his primary group (e.g. user1:user1,..). Instead, i want it to be owned by user1:sharegroup. Any ideas how to solve this? Thank you in advance!

Answer 1

You should look into using ACL permissions on the filesystem. You can set a "default" permission, and you can have multiple groups, users, etc.

https://help.ubuntu.com/community/FilePermissionsACLs

See the answer to this other post for more info:

https://superuser.com/questions/381416/forcing-group-and-permissions-for-created-file-inside-folder

Answer 2

Set the sgid bit so that it's enabled on the directory /home/sftp-all/shared, and make this directory's group sharegroup.

$ chmod g+s /home/sftp-all/shared

Finally make sure that any pre-existing files within /home/sftp-all/shared have their group set to sharegroup. This can be done like so:

$ chgrp sharegroup /home/sftp-all/shared/*

By setting the xgid bit on the directory, you're forcing what ever group owns, said directory, to be propagated any time new files are created within it. This approach will only work for newly created files, it won't, for example, enforce the group ownership if someone were to move files into this directory from somewhere else on the system.

However, given this is an SFTP server application, I can't think of any way a user would be able to move files into this directory, outside of SFTP.