I would like to limit a certain user (let's call it logger) to be able to only read some (not all) logfile (web, php framework, radius,etc).I am not sure how to do it the "best" way.
So far I have a chrooted sftp account for my user and I bind mount into his homedir (/home/logger) the required log folders, eg :
/var/log/nginx /home/logger/logs/nginx none _netdev,bind,defaults 0 0
and here is the lgos dir permissions :
dr-xr--r-- 5 logger logger 4096 mars 12 10:09 logs
However I had to add this user to certain groups (www-data, freerad).
logger : logger www-data freerad sftp
I don't think this is the proper way to do it. Moreover, user can delete some files (the www-data group has r+w permissions on the logs from the symfony app).
Ideally, I wish my user to have the least possible privileges (which means RO, I believe), and still be able to review all the logs he requires access to.
Can you please give me some hints on how you would do such a thing?
Thanks in advance.
EDIT : Following Arribah answer I have tried to use ACL, eg:
# file: radius/radius.log # owner: freerad # group: freerad user::r-- group::r-- group:logger:r-- mask::r-- other::---
logger user is inside logger group:
logger : logger sftp
I created a radius dir (in /home/logger):
drwxr-xr-x 2 root root 4096 mars 16 14:29 radius
Then I used some symbolic linking:
lrwxrwxrwx 1 root root 30 mars 16 14:29 radius/radius.log -> /var/log/freeradius/radius.log
Now I try to log via SFTP with logger to his chrooted homedir:
I can see files and folders and folders names, however if i try to get a file I have a "file not found" error trying to get that file radius/radius.log
I am really feeling stupid with this issue. :/