[LAU] OT: seeking help with uploading files via sftp and preventing their subsequent deletion

[Ivica Ico Bukvic]

All,

I am in a bit of a time-bind and am wondering if anyone could help me 
with this. Namely, I am trying to cobble a sftp system where conference 
participants may want to upload their proposed submissions and once they 
are uploaded that they are unable to delete their own or anyone else's 
submission. Going with commercial solutions is not an option.

So, what I did so far is change /etc/ssh/sshd_config so that sftp 
chroots said user's home dir, and prevents access via ssh. I also 
created a sftponly group and added the user to it. I adjusted home dir 
permissions and created a subfolder "submissions" where users can submit 
their projects. Finally, I added umask to strip permissions from 
uploaded files.

So, the /etc/ssh/sshd_config has the following entry

Match Group sftponly
ChrootDirectory /home/%u
ForceCommand internal-sftp -u 0222
X11Forwarding no
AllowTcpForwarding no

So, everything works, except no matter what permissions assign via 
umask, even if I change ownership manually via a different ssh user 
session, sftp client can still erase the file. How is this possible? And 
more importantly, how can one circumvent that? And perhaps most 
importantly is there an easier way to do this?

Below are permissions of folders in question:

drwxr-xr-x 3 root USER 4096 Oct 10 15:21 .
drwxr-xr-x 36 root root 4096 Oct 7 12:16 ..
drwxr-xr-x 2 USER sftponly 4096 Oct 10 19:39 submissions

Any idea how this can be fixed?

-- 
Ivica Ico Bukvic, D.M.A.
Associate Professor
Computer Music
ICAT Senior Fellow
DISIS, L2Ork
Virginia Tech
School of Performing Arts – 0141
Blacksburg, VA 24061
(540) 231-6139
ico at vt.edu
www.performingarts.vt.edu
disis.music.vt.edu
l2ork.music.vt.edu