How do I allow multiple SFTP Users with S3FS and OpenSSH?
Everything works, except SFTP Users don't have permission to write to their Chrooted Home Directory: remote open("/some_file"): Permission denied
Setup
I've got an Amazon EC2 instance running Amazon Linux. I've installed S3FS and mounted an S3 bucket. I've also configured OpenSSH to allow SFTP Users to access a Chrooted Home directory inside the mounted S3 Bucket /s3_mounted_folder/user_folder/
. I've successfully used the SFTP connection on a non S3 mounted directory. I've successfully used the S3 bucket to create and download files from S3 as root on the EC2 instance via SSH. My SFTP users can successfully download files from their /s3_mounted_folder/user_folder/
directory. The problem is that the SFTP users cannot put
files into the S3 mounted folder.
The Problem ... I think
I am only able to configure all folders (/s3_mounted_folder/
and /s3_mounted_folder/user_folder/
)with the same user:group and same permissions, thus, I can't give the user access to write to his/her home directory (/s3_mounted_folder/user_folder/
). If I mount the bucket with the user or group and give either write permissions, then OpenSSH SFTP won't let users connect because it believes the user permissions are misconfigured (example: drwxr-xr-x 1 root root
vs. drwxrwxr-x 1 root usergroup
).
S3FS Commands
Here are the two different commands to launch S3FS in these two modes (where user 501 and group 501 are the SFTP user and group):
root user permissions (drwxr-xr-x 1 root root
): sudo s3fs nwd-sftp /sftp/ -o iam_role=sftp-server -o allow_other -o umask=022
sftp user permissions (drwxrwxr-x 1 root usergroup
): sudo s3fs nwd-sftp /sftp/ -o iam_role=sftp-server -o allow_other -o umask=002 -o gid=501
In that second scenario, the user would theoretically be able to put
files into their home directory via SFTP, but SFTP won't let them connect because their Chrooted home directory has write permissions for a group that isn't root.