0

I run a SFTP and Samba server on the same machine. In order to access the SFTP more conveniently in the local network it should be also accessible from there. For this I bind mounted it into an existing Samba share (sudo mount --bind /home/sftp_user/share/ /path/to/samba/share/sftp-share/).

I jailed the SFTP directory like this:

sudo chown root:root /home/sftp_user
sudo chmod 0755 /home/sftp_user

sudo mkdir /home/sftp_user/share
sudo chown root:sftponly /home/sftp_user/share
sudo chmod 0755 /home/sftp_user/share

Some restrictions:

  • I cannot add the Samba user to the sftponly group since ssh would not work anymore (the user has both ssh and Samba access)

  • SFTP auth works with key files; ssh auth with 2fa(password + OTP) -> this authentication methods should stay like this

  • Changing the owner of share to the Samba user works partly: I can add files via SFTP and Samba but the SFTP user can (obviously) not delete files from the Samba user

      sudo chown samba_user:sftponly /home/sftp_user/share
    

The only option which seem to work is setting the permissions quite broad:

sudo chown root:sftponly /home/sftp_user/share        # Stays the same
sudo chmod 0777 /home/sftp_user/share

This raises some security concerns.

In general for every user it would be O.K. to access (read and write) /home/sftp_user/share (via Samba or SFTP). Is the working example the way to go or are there better (secure, but not too complicated) solutions to this (ACLs are probably an option but I think this would be an overkill in this case).

2
  • What version of Ubuntu are you using?
    – David
    Jan 21 at 14:51
  • VERSION="18.04.5 LTS (Bionic Beaver)" Jan 21 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.