0

I setup chrooted users on an Amazon Linux development instance to grant them access to the /var/www folder. It was working fine, but after a yum update (November I think), the users can no longer edit/create files and folders in the /var/www directory.

I read this thread: SFTP suddenly failing for chroot accounts on Amazon Linux

...which seems to identify the issue, but was not clear if that was referring to my issue. My chroot still works, but the members of the group can no longer edit files in the /var/www directory. The permissions look correct to me - perhaps I am missing something.

To setup the original chroot, I setup a group sftpusers, edited the sshd_config file, added the users and chrooted them to /var/www.

I created a group called devusers and added the chrooted users to this group and set permissions on the files and directories.

If I disable the chroot, users in the devusers group can edit files fine in /var/www. However, if I chroot them, they can see the files okay, but cannot make edits.

Again, this was working fine until the update. Thoughts?

Here is my SSH version:

OpenSSH_6.6.1p1, OpenSSL 1.0.1k-fips 8 Jan 2015

Here are my permissions:

[root@ip-10-0-28-11 var]# ls -la
drwxr-xr-x 20 root root 4096 Jul 24  2015 .
dr-xr-xr-x 26 root root 4096 Feb 18 17:22 ..
drwxrwxrwt  2 root root 4096 Feb 18 17:21 tmp
drwxr-xr-x  9 root root 4096 Jul 19  2016 www
[root@ip-10-0-28-11 var]#

[root@ip-10-0-28-11 www]# ls -la
drwxr-xr-x  9 root   root   4096 Jul 19  2016 .
drwxr-xr-x 20 root   root   4096 Jul 24  2015 ..
drwxr-xr-x  2 root   root   4096 Jul 19  2016 cgi-bin
drwxr-xr-x  3 root   root   4096 Jul 26  2016 error
drwxrwsr-x 14 apache devusers    4096 Nov 11 20:29 html
drwxr-xr-x  3 root   root   4096 Jul 26  2016 icons

[root@ip-10-0-28-11 html]# ls -la
drwxrwsr-x 14 apache devusers  4096 Nov 11 20:29 .
drwxr-xr-x  9 root   root 4096 Jul 19  2016 ..
drwxrwsr-x  2 apache devusers  4096 Oct  1 00:03 testdir
0

After some additional testing, I was able to answer my own question and wanted to post in case that helps someone else.

After reading through @Will answer in the above link again, I changed the primary group for my SFTP users to the the GID for the devusers group and it worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.