I have an SFTP server running on Ubuntu Server 12.04 LTS. Any users in the 'sftponly' group are chrooted into their home directory upon connection. As OpenSSH requires the ChrootDirectory to be owned by root, each user has a sub-folder named 'upload' that they have permission to write to. This all works well, and users are restricted to their own area, whether they are aware of it or not.
I would now like to provide access via HTTP/HTTPS for users to download files using just a web browser. I have been looking into Apache's mod_userdir, but this seems to be geared more towards anonymous access. I would like the system to require the user to authenticate before being able to download from their folder. It should also only allow them to download from their folder.
For example, a user would visit https://download.example.com/testuser/file.zip and be required to authenticate using the same credentials as they would when connecting via SFTP to download the file.
I've been looking into solutions like creating a seperate virtual host for each user, and manually creating htaccess files in each home dir, but they seem kind of untidy.
Any suggestions greatly appreciated.