Read only SFTP by user

ivanmacx · 03-02-2013, 08:25 AM

Is it possible to set up sftp users with varying permissions on the same filesystem. I have successfully set up an sftp system (on Amazon EC2) using OpenSSH on Debian (OpenSSH_5.5p1 Debian-6+squeeze2) and chrooting different groups of users to different directories. All works fine and people can log in and upload and download as required.

I have a new user I want to add, accessing the same files as the other users, but with read-only access and I can't find any way to do that.

Is there any way to set access permissions by user?

If not can anyone suggest a workaround (eg. readonly --bind mount which I can't quite work out how to do) to achieve what I'm after?

Thanks.

chrism01 · 03-03-2013, 10:51 PM

Try Match User ...
http://www.openbsd.org/cgi-bin/man.c...nfig&sektion=5
http://security.stackexchange.com/qu...methods-in-ssh

ivanmacx · 03-05-2013, 03:15 AM

Thanks. Yes, I can match user but I don't know how to then set read only permissions for those users. Any idea?

sag47 · 03-05-2013, 08:34 AM

Why not change the permissions of the home directory an all child directories to something like...

Code:

chmod 774 /home/sharedhome

#propagate to all directories
find /home/shardhome -type d -exec chmod 774 {} \;
chmod 700 /home/sharedhome/.ssh

Then any users which are part of the group for that folder has rwx access. Make sure that your readonly user isn't the owner and not in a group with rwx. Then that user will only have read permission.

ivanmacx · 03-06-2013, 04:38 PM

Unfortunately what I need is that the same set of directories are read/write for a group of users (eg. 5 people) and read only for another 3 users, and no access for anyone outside those groups. I don't think I can achieve that with group permissions.

The only route I see at present is to set up a readonly directory and do a readonly --bind mount of the relevant directories within that folder, and then chroot the read only users to that directory. I guess that's the only solution.

chrism01 · 03-06-2013, 06:43 PM

How about setting up rw users as a group, then ro users as ro via ACLs?

Turbocapitalist · 03-08-2013, 05:32 AM

The sftp subsystem can be set to be read only using -R. See the man page for sftp-server(8) Match won't allow specifying a subsystem, so the change has to be done another way. One way would be to have two ssh systems running on the same machine but on different ports. One would be set to allow only the members of the read-write group to log in. The other would allow everyone to log in, but would put the sftp subsystem into read-only mode.

sag47 · 03-09-2013, 03:03 PM

PAM with SELinux could be used for this issue. Though SELinux isn't on Ubuntu by default so you'd either have to change that or see if there's an apparmor equivalent configuration with PAM. SELinux could be used to enforce the users ability on the system and PAM can determine whether or not they're allowed to log in. For example PAM can be configured that if SELinux is set to permissive they're not allowed in but when it's enforcing they are.