I have some users on my Ubuntu server with vsftpd installed.
The server is used as web server and has a shared sftp directory that is accessed by public clients (by giving them the user and password).

Due to that architecture, my goal was to restrict the public client user to access his home directory only and restrict the access to the other directorys. I did it using ChrootDirectory as follows:

  • create the public user: public_sftp with the home dir: /home/public_sftp/
  • /home/public_sftp is owned by root
  • Inside /home/public_sftp, there are two dirs owned by public_sftp:www-data
  • create a group sftponly
  • add the public_sftp in the sftponly group
  • Change the /etc/ssh/sshd_config and add at the end

    Match group sftponly
        ChrootDirectory %h
        X11Forwarding no
        AllowTcpForwarding no
        ForceCommand internal-sftp -u 73

This works perfectly fine, except for a script that I need to run from another server using www-data user. When lunching that script that will connect to the sftp server with the www-data user, I am getting:

Write failed: Broken pipe
rsync: connection unexpectedly closed (0 bytes received so far) [sender]
rsync error: unexplained error (code 255) at io.c(605) [sender=3.0.9]

The home dir of my www-data user is /var/www/ and the rsync scrypt is trying to write in a sub directory from /var/www.

  • when chrooted, e.g your /home/public_sftp will be root / directory. user will be confined to their home directory. you path should be always start with / . Jun 5, 2019 at 5:11

1 Answer 1


POSIX ACL (access control lists) are useful for that you describe. They allow a finer-grained permission model compared to the user:group:other model. I have found them to be easier to keep straight in my head since I can be more explicit and can also set the "default" behavior for a branch of the file system.

For example, you can specify each user's permissions explicitly:

setfacl -Rm d:u:userA:rwX,u:userA:rwX /var/www
setfacl -Rm d:u:userB:rwX,u:userB:rwX /var/www

Or you can do it based on some shared group:

setfacl -Rm d:g:groupA:rwX,u:groupA:rwX /var/www

And perhaps you want to keep your web server user as read-only

setfacl -Rm d:u:www-data:rX,u:www-data:rX /var/www

Man pages:

http://linux.die.net/man/1/setfacl http://linux.die.net/man/1/getfacl https://websistent.com/linux-acl-tutorial/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .