Been scouring the interweb for solution to this but all answers refer to either groups, folder owners or_all_users.

In my case, I have my own user ("kai") and several others who use the machine.

I have a folder "/home/kai/projects.complete" I can edit files via the shell and SFTP into it.

However I now have a requirement to allow a second/third user read-only access to all files within /home/kai/projects.complete The users are not currently set up on the machine at all.

The best solution I've found is to set folder permissions to rwxrwxrrr to allow myself and my own personal group access to read/write/execute items and all other users to read-only. However, I don't want all other users to have access.

Say my example user is jonny.

I want to be create the user jonny with his own password and give him read only access to /home/kai/projects.complete He needs read-only access to all files and directories within projects.complete He also needs to be able to access the box via SSH and use SFTP the same way as I do, ideally with his default directory in SFTP being /home/kai/projects.complete (nice to have)

I need a bash command or script that will do the following: a) Add user user with password b) Grant the user read-execute in the folder /home/kai/projects.complete, along with all of its sub-directories and files. If possible, I'd like the shell to default to this folder instead of /home/jonny/ (but this is just a nice to have) c) Allow the under SSH and FTP access to download any files within /home/kai/projects.complete d) Disallow access to any other folders or files (must only be able to access /home/kai/projects.complete and its sub-directories & files) e) When users logs in on to FTP, I'd like the user to automatically be taken to the directory /home/kai.projects.complete (again, this is the nice to have - they can always navigate manually or set the default path in the FTP client).

Can anyone give me a solution that doesn't involve me completely changing the permissions of groups or all users? There will come a point where other users are added but shouldn't have access to these files.


  • Do you know about ACLs? I feel they should address your problem quite well, but I'm don't have much experience with them, so I can't quickly write a proper answer. Search the Internet for linux acl tutorial, there are many results. Commented Dec 17, 2016 at 15:04

1 Answer 1


For the protection/permission part, if your filesystem supports ACLs, yo may run

setfacl -R -m u:jonny:r /home/kai/projects.complete
setfacl -R -m default:u:jonny:r /home/kai/projects.complete

which reads:

Set (-m) the access control list (ACL) recursively (-R) for user jonny readonly (u:jonny:r) on the directory /home/kai/projects.complete, and set the default ACL to the same, which says that every directory newly created below will get the same ACL automatically. You also have to make sure that 'others' do not have any access to your directories: chmod -R o-rwx /home/kai

It will not be possible to give jonny a readonly directory as home directory, as with login/logout there are files written to the home directory.

For the configuration of FTP, this depends on the FTP server you are using. Most of them chroot to the home directory (or some other, if configured), so the FTP user cannot change to some directory outside. Look into the description of your FTP server.

To access a folder outside the chroot jail, see e.g. http://www.ducea.com/2006/07/27/allowing-ftp-access-to-files-outside-the-home-directory-chroot/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .