I'd like to prevent users from deleting files they have uploaded to my sftp server. I know I could set up a solution of my own using inotify/dnotify (or pam hook) and lsof which triggers a script to do something such as chattr +i $filename after a file is uploaded and closed. But I wonder if there is something already available as a feature or a solution already vetted and available of which I'm not aware.

The current setup is that I'm using openssh sftp and users are jailed upon connecting.


Look at lsyncd(http://code.google.com/p/lsyncd/). It will provide inotify=>action part for your solution. It will look like this:

cat /etc/lsyncd.conf 
settings {
    logfile    = "/var/log/lsyncd.log",
    statusFile = "/var/run/lsyncd.status",
    nodaemon   = false,
    insist     = true,

-- config action
my_config = {
    delay = 10,
    maxProcesses = 1,
    onCreate  = "chattr +i -R /path/to/dir/*",

sync { my_config,
-- EOF

you can change onCreate action for better logic, maybe run a script which will find uploaded files and set chattr +i.

| improve this answer | |
  • you saw that I'm using openssh sftp, correct? It's not an option for me to switch to vsftpd at this time. – RaWkStAr Aug 18 '15 at 21:52
  • Em...actually it's doesn't matter what daemon you use – Navern Aug 18 '15 at 21:54
  • I've removed word vsftpd for more clarity – Navern Aug 18 '15 at 21:56
  • Your example worked, and I was able to install it as an official debian package. It's also available from the epel repository. I did have to make some changes though. /etc/lsyncd.conf didn't work. When I opened the systemd unit startup script for lsyncd I saw that it expected its config file to be at /etc/lsyncd/lsyncd.conf.lua ...After tweaking that, things worked well! – RaWkStAr Aug 18 '15 at 22:53
  • 1
    Glad that my solution helped you:) – Navern Aug 19 '15 at 13:53

If you add your sftp-server umask option -u with parameter 0222, new uploaded files will be created with above mentioned umask, which means they will not have write access for their files, so they will not be able to delete the files.

The line in your sshd_config will look something like this:

Subsystem sftp internal-sftp -u 0222
| improve this answer | |
  • Very nice. I didn't see this in the man page for sshd_config because it's in the man page for sftp-server / internal-sftp. Because I'm using a Match Group ... block for users of a certain group to make sure they're jailed, I think It will look like this, no? Match Group chrooted ...other lines ... ForceCommand internal-sftp -u 0222 – RaWkStAr Aug 18 '15 at 22:11
  • using ForceCommand internal-sftp -u 0222 in the match block indeed created the file as -r--r--r-- but I was able to delete the file. I was also able to chmod the file to other perms. – RaWkStAr Aug 18 '15 at 22:34
  • 1
    Hmm. Chmod should be possible to disable using -P option to sftp-server. But if user is able to delete the file, then there is something wrong ... – Jakuje Aug 19 '15 at 6:37
  • if a user has mode 0444 on a file, deletion is still possible. – RaWkStAr Aug 19 '15 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.