I have sftp users that place files regularly in their own home directories which I've followed the guide on digitalocean to restrict their access to only their home directories. See here
This works great.
I also have an api which is managed using nginx and ran using the www-data user. Within that api I have an endpoint which executes script elsewhere on the server. This script scans the ftpuser directories and uploads the files to a db. I've done this because my ideal situation is that each user can upload their files and then initiate the upload when they're done using a simple api call.
I created a group
api_access and added www-data to it. Then I went to the sftp users directories and created a
rwx ACL for that
api_access group. Unfortunately, this broke my chrooted sftp for some reason and I had to remove the ACL on the parent directory
/home/ftpuser/. At this stage my www-data user can read the files, but could not execute the
mv command (failed on the move with a "permission denied" error)
I left the ACL on the subdirectories (specifically /data/ and /archive/) since that's where I wanted the permissions anyway. However the script still fails.
I've managed to get it to work by adjusting the permissions on the /data/ and /archive/ directories using
chmod -R o:rwx <folder> but this is not what I want. Besides the ftp user and the ftpaccess group, I want the api_access group to be the only other ones with access to these folders.
Can someone explain why my ACL failed and how I should have constructed it?
getfacl data/ returns:
# file: data # owner: ftpuser # group: ftpaccess user::rwx group::r-x group:api_access:rwx mask::rwx other::rwx default:user::rwx default:group::r-x default:group:api_access:rwx default:mask::rwx default:other::r-x