Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to provide an FTP service that needs to be web-managed in the simplest way possible. My customer wants to create folders and users, and give them read only or read/write access arbitrarily.

For example:

The folder 'Documents' should be read only for several users, writable for internal users, and invisible for the rest.

The folder 'Pictures' should be read only for journalists, writable for associates, and invisible for the rest.

The folder 'Media' should be read only, writable or invisible for arbitrary users specified on the admin.

There could be a large number of users and folders.

I can't find a good way to accomplish that.

I thought that I could give each user a home folder and put symlinks for the folders he has read access to, and make the user part of the folder's group when he has write access too, but now I think that this wouldn't work, because with PureFTPd (or ProFTPd) I can only specify the virtual user's mapping to a system user, and only one GUID for each virtual user. My approach requires that I could specify several GUIDs for each user (one by each folder he has write access to).

I need to start programming this admin and I still don't know wich approach would work, if any.

The question is: How to give arbitrary permissions to 20 folders or so, to a large number of FTP users?

share|improve this question
up vote 3 down vote accepted

Will ACL work for you? For Ubuntu 10.10, mount file systems with the acl option.

sudo vim /etc/fstab

UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx / ext4 defaults,acl 0 1

sudo mount -o remount,acl /

(or maybe there is a separate /home/ partition?) Make groups for this purpose.

sudo groupadd journalists
sudo groupadd associates
sudo usermod -a -G journalists $username_1
sudo usermod -a -G associates $username_2

(The users need to log out and in again to become a member of a group.)

Just to illustrate on a directory, /home/ftp/Pictures, to accomplish "The folder 'Pictures' should be read only for journalists, writable for associates, and invisible for the rest.":

sudo chown -R /home/ftp/Pictures
sudo chmod 0770 /home/ftp/Pictures
sudo chmod g+s /home/ftp/Pictures
sudo setfacl -d -m u::rwx,g::rwx,o::--- /home/ftp/Pictures
sudo setfacl -d -m u::rwx,g:journalists:r-x,o::--- /home/ftp/Pictures

Now you've got members of the associates group able to read/write everything in /home/ftp/Pictures, while members of journalists can only read (execute) and everyone else has no permission at all.

If we wanted to restrict delete and rename from all but the user who created the file:

sudo chmod +t /home/ftp/Pictures
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.