Create FTP users

usatn

How can I create a FTP user can only access to certain directory.

i.e.

Create a user 'fone' and allow access ~/apps/thisapp/public/tone/ and everything (including files and directories) under /tone.
When user 'fone' login via FTP, default path is '~/apps/thisapp/public/tone/'

Thank you.

sean

usatn

Create the new shell user "fone": Managing Shell Users | Opalstack Support Center
Grant access to the directory by following these instructions: HOWTO grant access to a directory
In the SFTP client settings, set the default path to /home/fone/tone.

usatn

Thank you!

fredhead

@sean What commands would be used to permission a shell user to a specific folder without re-creating the .mozilla, app, and logs folders?

I have a set of files for several partners to download. The folders contain only PDF files. And multiple shell accounts would need to be permissioned to use SFTP to log in and arrive automatically in the specified folder with PDFs.

I used the commands in the HOWTO grant access to a directory page, using $HOME/myfiles as the directory, but logging in drops me off at some other folder which includes .mozilla, apps, and logs folders etc.

sean

fredhead we don't have "SFTP-only" shell users the way that WebFaction did so all of those files and directories are created as part of the setup. You can't delete the apps and logs directories and I don't recommend deleting the .bashrc and .bash_profile files, but feel free to delete whatever else.

If you want the user to drop into some specific directory after they log in to SFTP then set your initial directory via your SFTP client settings.

holgate

A belated reply to this: the setfacl / chmod commands in the FAQ give userB the ability to upload / rename / delete their own files in the chosen directory via SFTP, but not the permissions to overwrite userA's existing files. Is there an easy way to change that?

(Yes, in hindsight the app should have had its own shell user, but rejigging that after the fact...)

sean

holgate If you follow the instructions precisely then you shouldn't have the issue you're reporting, ie userB will be able to overwrite a file owned by userA in the shared directory.

You should be able to run getfacl in the directory that has this issue to see what the current ACL is and then you can run whatever setfacl command is necessary to correct whatever problem you find.

If that's not working for you then please email support with the details (ie the directory and the name of the second user) and we'll look into it.

pembertron

Found out how to not allow userB into any other directories , add in -
setfacl -m u:userB:--x $HOME/apps/*

So the sequence is -
setfacl -m u:userB:--x $HOME
setfacl -m u:userB:--x $HOME/apps/*
setfacl -R -m u:userB:rwx $HOME/apps/myapp
setfacl -R -m d:u:userB:rwx $HOME/apps/myapp
setfacl -R -m d:u:userA:rwx $HOME/apps/myapp
chmod g+s $HOME/apps/myapp

If you can confirm this sean please.
Thanks

pembertron

In relation to creating FTP users and following https://docs.opalstack.com/topic-guides/tips/#howto-grant-access-to-a-directory how do I stop userB being able to see all the other directories, files and being able to view/ download them in $HOME/apps/ or stop them being able to enter other directories apart from the chosen 'myapp'?
I have looked at the syntax for setfacl and it is beyond me!!
Thanks.

sean

pembertron the permissions in your ACL aren't quite correct.

Directory permissions work like this:

Read (r) controls the ability to list the contents of a directory.
Write (w) controls the ability to modify the contents of a directory.
Execute (x) controls the ability to navigate into/through a directory.

So, if you set the ACL permissions for userB to --x you're actually granting access to the directory, not denying it.

If your goal is to deny access then the permissions you want are ---, so the command you want is: setfacl -m u:userB:--- $HOME/apps/*.