1

I'm building an sFTP solution but I can't stop group1user from seeing or more exactly listing group2user's directories. I've configured it so that group1user can't actually get into group2user's directories but they can actually see the directory name when they connect via FileZilla.

File structure =

         /upload/group1Directory

         /upload/group2Directory

dave is the owner and can see and enter both group1Directory and group2Directory

The current permissions look like this

rwxr-xr-x.   4 root root          46 Feb 17 09:55 upload

drwxr-x---. 2 dave group1     60 Feb 17 11:09   group1Directory
drwxr-x---. 2 dave group2     61 Feb 17 11:09   group2Directory

the sshd_config looks like this

Match User dave
        ForceCommand internal-sftp -u 0002
        #PasswordAuthentication yes
        ChrootDirectory /upload
        PermitTunnel no
        AllowAgentForwarding yes
        AllowTcpForwarding yes
        X11Forwarding yes
        PubkeyAuthentication yes

Match User group1user
        ForceCommand internal-sftp -u 0002
        #PasswordAuthentication yes
        ChrootDirectory /upload
        PermitTunnel no
        AllowAgentForwarding yes
        AllowTcpForwarding yes
        X11Forwarding yes
        PubkeyAuthentication yes

Match User group2user
        ForceCommand internal-sftp -u 0002
        #PasswordAuthentication yes
        ChrootDirectory /upload
        PermitTunnel no
        AllowAgentForwarding yes
        AllowTcpForwarding yes
        X11Forwarding yes
        PubkeyAuthentication yes

Any ideas how I can hide group2user's directory from group1user?...and vice-versa? Any help very gratefully received

Improve this question
4
  • Isn't it possible to ChrootDirectory /upload/group1Directory and respectively ChrootDirectory /upload/group2Directory? Also dave could be a member of the both groups and the directories could have setgid bit enabled: chmod g=rws group1Directory/ group2Directory/.
    – pa4080
    Feb 18, 2022 at 17:31
  • Do you want them to not view any directories at all, or be able to access their own? Either way, here is a similar question that could have some insight. superuser.com/questions/161187/…
    – Logan
    Feb 18, 2022 at 17:36
  • Also Match Group can be more flexible way to define chroot.
    – pa4080
    Feb 18, 2022 at 17:39
  • 1
    The members of one group cannot enter the directory of the other group. But you don't want them to see the directory name at all? Is there a reason for this? Perhaps you can explain why you want to do this since most people don't mind as long as they can't get in. Maybe it'll make it easier for someone to help you?
    – Ray
    Feb 18, 2022 at 17:47

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.