I have a ubuntu 12.04 app server hosting a few websites. We need to give access to the developer to only be able upload files to one of the websites. I have installed Jailkit but can't seem to find how to give him sFTP access to the website directory.

Here is our web directory structure:

/var/www/website.com/htdocs/ /var/www/someotherwebsite.com/htdocs/ /var/www/website3.com/htdocs/ all owned by www-data:www-data

Can someone give me some step by steps to giving a user access to only one or two of these directories via sFTP and no ssh access?

  • Why don't you just set up FTP for that? sFTP isnt that flexible with access permissions... – Thomas Ward Nov 1 '12 at 13:26
  • honestly I didn't think about it except that I don't have ftp on the server for security reasons. – John Hamman Nov 1 '12 at 16:14

In general, that is not a practical directory structure for reasons you are encountering. If you only have one website, then the /var/www dirctory might be just fine. However, in my experience, 20+ years, the best approach is to create a separate home partition so that the home partition can be mounted nosuid, noexec, nodev, et al. Each website has its own system user account. That account is given a shell, rssh, which allows sftp but no ssh. This is practical when hosting, when hiring developers, or even from a security point of view.

Having written that much, one solution becomes clear: move the sites to user account directories and update the web server configuration. This can be done safely by creating a copy of the website on a subdomain. For example, for the domain, www.website.com, create a CNAME called test.website.com. Make sure the site on test.website.com is working. Then, update the web server config file to point www.website.com to the new location once you know it is flawless.

At that point, you can provide access via sFTP to whomever you please without this concern.

But... to get to the point and answer the question: a less obvious but effective solution is to use ACL. With ACL, you can get much better fine-grain controls on file system permissions. Using ACL can provide the desired restrictions.

The first thing to do is to install the acl software:

sudo apt-get install acl

The next thing to do is to mount or remount the filesystem with the ACL option.

sudo -e /etc/fstab

You might see a line like this, so add the acl option.

UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx / ext4 defaults,acl 0 1

Save and quit. Remount with acl enabled.

sudo mount -o remount,acl /

After this, you will have access to ACL. There is guide for ACL on help.ubuntu.com. Some examples of ACL usage on askubuntu.com:

Managing arbitrary user permissions under PureFTPd

Whats the simplest way to edit and add files to "/var/www"?

  • Do you have any articles that show how I can do exactly what you suggested (the partition part) on a ec2 server [if that matters]. Currently the /var/www/ is on it's own ebs mount. Can I just remount that with nosuid, noexec, nodev? And are you saying that I should have a separate mount for each site or one for all sites? – John Hamman Jan 16 '13 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.