I setup chrooted users on an Amazon Linux development instance to grant them access to the /var/www folder. It was working fine, but after a yum update (November I think), the users can no longer edit/create files and folders in the /var/www directory.
I read this thread: SFTP suddenly failing for chroot accounts on Amazon Linux
...which seems to identify the issue, but was not clear if that was referring to my issue. My chroot still works, but the members of the group can no longer edit files in the /var/www directory. The permissions look correct to me - perhaps I am missing something.
To setup the original chroot, I setup a group sftpusers, edited the sshd_config file, added the users and chrooted them to /var/www.
I created a group called devusers and added the chrooted users to this group and set permissions on the files and directories.
If I disable the chroot, users in the devusers group can edit files fine in /var/www. However, if I chroot them, they can see the files okay, but cannot make edits.
Again, this was working fine until the update. Thoughts?
Here is my SSH version:
OpenSSH_6.6.1p1, OpenSSL 1.0.1k-fips 8 Jan 2015
Here are my permissions:
[root@ip-10-0-28-11 var]# ls -la
drwxr-xr-x 20 root root 4096 Jul 24 2015 .
dr-xr-xr-x 26 root root 4096 Feb 18 17:22 ..
drwxrwxrwt 2 root root 4096 Feb 18 17:21 tmp
drwxr-xr-x 9 root root 4096 Jul 19 2016 www
[root@ip-10-0-28-11 var]#
[root@ip-10-0-28-11 www]# ls -la
drwxr-xr-x 9 root root 4096 Jul 19 2016 .
drwxr-xr-x 20 root root 4096 Jul 24 2015 ..
drwxr-xr-x 2 root root 4096 Jul 19 2016 cgi-bin
drwxr-xr-x 3 root root 4096 Jul 26 2016 error
drwxrwsr-x 14 apache devusers 4096 Nov 11 20:29 html
drwxr-xr-x 3 root root 4096 Jul 26 2016 icons
[root@ip-10-0-28-11 html]# ls -la
drwxrwsr-x 14 apache devusers 4096 Nov 11 20:29 .
drwxr-xr-x 9 root root 4096 Jul 19 2016 ..
drwxrwsr-x 2 apache devusers 4096 Oct 1 00:03 testdir
After some additional testing, I was able to answer my own question and wanted to post in case that helps someone else.
After reading through @Will answer in the above link again, I changed the primary group for my SFTP users to the the GID for the devusers group and it worked.