Denying timestamp modification on SFTP server

Question

I have a linux SFTP server which I use to share files with other people.

There is a script that automatically find and delete files uploaded more than 10 days ago:

find . -not -path . -mtime +10 -exec rm -frv {} \;

I've noticed that some SFTP clients preserve last modified date, causing the script to delete the files sooner than expected.

For instance, if Today is 15th of December, and a client upload a file that he modified on his computer on the 1st of December, the file gets deleted immediately, instead of the 25th of December.

So, how can I deny the clients to change last modified attribute after the upload?

Answer 1

The sftp-server (and the compatible internal-sftp) has the -P and -p switches to black/white list certain SFTP requests.

You can use them to disallow setstat and fsetstat requests:

Subsystem sftp internal-sftp -P setstat,fsetstat

Note that this will disallow also permissions (and other attributes) changes.

You can of course do this per-user (or per other criteria) using the Match directive.

Answer 2

You cannot do this cleanly and you are acting "against" Unix/Linux established practices. The expected way to do your task is to use -mtime +10 -ctime +10, that is delete files that are older with respect to both mtime and ctime.

Many tools that operate files set mtime back to the past when the contents meaningfully changed. But the ctime ("inode change time") is an indicator that something about the file has changed: mtime or contents or permissions or other metadata.

Also warning: your script will have unintended consequences because it checks also mtime of directories and deletes whole directories. When you write to files, directory's mtime and ctime doesn't change, thus files will be deleted as a result of rm -r ./that/directory