I run a SFTP and Samba server on the same machine. In order to access the SFTP more conveniently in the local network it should be also accessible from there. For this I bind mounted it into an existing Samba share (
sudo mount --bind /home/sftp_user/share/ /path/to/samba/share/sftp-share/).
I jailed the SFTP directory like this:
sudo chown root:root /home/sftp_user sudo chmod 0755 /home/sftp_user sudo mkdir /home/sftp_user/share sudo chown root:sftponly /home/sftp_user/share sudo chmod 0755 /home/sftp_user/share
I cannot add the Samba user to the
sshwould not work anymore (the user has both
sshand Samba access)
SFTP auth works with key files;
sshauth with 2fa(password + OTP) -> this authentication methods should stay like this
Changing the owner of
shareto the Samba user works partly: I can add files via SFTP and Samba but the SFTP user can (obviously) not delete files from the Samba user
sudo chown samba_user:sftponly /home/sftp_user/share
The only option which seem to work is setting the permissions quite broad:
sudo chown root:sftponly /home/sftp_user/share # Stays the same sudo chmod 0777 /home/sftp_user/share
This raises some security concerns.
In general for every user it would be O.K. to access (read and write)
/home/sftp_user/share (via Samba or SFTP). Is the working example the way to go or are there better (secure, but not too complicated) solutions to this (ACLs are probably an option but I think this would be an overkill in this case).