I have sftp users that place files regularly in their own home directories which I've followed the guide on digitalocean to restrict their access to only their home directories. See here

This works great.

I also have an api which is managed using nginx and ran using the www-data user. Within that api I have an endpoint which executes script elsewhere on the server. This script scans the ftpuser directories and uploads the files to a db. I've done this because my ideal situation is that each user can upload their files and then initiate the upload when they're done using a simple api call.

I created a group api_access and added www-data to it. Then I went to the sftp users directories and created a rwx ACL for that api_access group. Unfortunately, this broke my chrooted sftp for some reason and I had to remove the ACL on the parent directory /home/ftpuser/. At this stage my www-data user can read the files, but could not execute the mv command (failed on the move with a "permission denied" error)

I left the ACL on the subdirectories (specifically /data/ and /archive/) since that's where I wanted the permissions anyway. However the script still fails.

I've managed to get it to work by adjusting the permissions on the /data/ and /archive/ directories using chmod -R o:rwx <folder> but this is not what I want. Besides the ftp user and the ftpaccess group, I want the api_access group to be the only other ones with access to these folders.

Can someone explain why my ACL failed and how I should have constructed it?

getfacl data/ returns:

# file: data   
# owner: ftpuser  
# group: ftpaccess   


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.