I have a VPS running ubuntu 12.04 that is hosting about 9 sites which are a mix of wordpress and joomla (latest versions).

Apache runs under www-data and sites are hosted as virtualhost under /var/www/{sites}

Today I disabled FTP (insecure) and replaced it with SFTP. I've set this up so that every site/virtualhost has a SFTP user that is chrooted. when you login as SFTP user you get chrooted into /usr/local/chroot/{user}, in this directory i've mounted the specific virtualhost this user needs access to (with mount --bind /var/www/{subdomain} /usr/local/chroot/{user}/web)

the SFTP users are setup so that they can only SFTP and not SSH and their shell is set to /sbin/false

the only problem/question I have is with the user permissions. the sites run as www-data so when I upload something in for example joomla the file is created with www-data:www-data ownership. however if i upload a file using SFTP it's uploaded as {user}:www-data. this can lead to problems with permissions.

what would be the best way to handle file-ownership and permissions in this case? Also is the way I set this up safe?


Simple way, if you're sure of your security settings: set the suid bit on the main folder. But I don't see what permission troubles you'd have anyway, since the group is already set on www-data.

| improve this answer | |
  • So I would have to add my SFTP users to the www-data group as well? this is not the case currently since I was not sure if this would create a security risk – iggnition Dec 24 '13 at 15:20
  • also i problem i run into is, when I upload a file through joomla the ownership is www-data:www-data and the permissions are RWX-R--R-- this means that when i try to delete this file via SFTP I get an access denied (this was the problem I was speaking of) – iggnition Dec 24 '13 at 15:27
  • If they aren't already, how can they write in that folder? Did you give complete access to the folder to just anyone? Anyway if you set the suit bit on a folder you will create items inside it as if you were the original owner. If you set the guid bit, it will keep the original folder's group. There are several possibilities available for setting write permissions on that folder, the choice is yours. Honestly on my servers I have been lazy; I put my users inside apache's group and set both suid and guid on their main folder. – stoned Dec 24 '13 at 15:27
  • the usmask of uploaded files must usually be set by the ftp program; honestly I dunno if you can force that throught sftpd especially if you use restricted access through, for example, rssh. But check out this link. If everything fails, go with the suid bit. – stoned Dec 24 '13 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.