Error: Bad ownership or modes
Note: This page applies to SFTP Gateway version 2.x. Visit Here for documentation on version 3.x.
You receive the following error:
Nov 11 13:06:31 rob-vm sshd: fatal: bad ownership or modes for chroot directory component "/home/robtest/home/robtest/" [postauth]
This is caused by permissions set on the chroot directory.
The fix is to remove the SFTP user's write access to the chroot directory.
Why the error is happening
SFTP Gateway uses the default OpenSSH implementation found in Linux. OpenSSH does not allow SFTP users to have write access to their chroot directory, for security reasons.
As a result, an SFTP connection's authorization will fail, even if the authentication succeeded.
SFTP users may request write access to the root of their chroot directory. It may be tempting to grant them write access:
chmod u+w /home/robtest/home/robtest
Unfortunately, this will result in the SFTP user no longer being able to log in.
Fixes and workarounds
In order to let the SFTP user log in again, you will need to remove their ability to write to the chroot directory:
chmod 755 /home/robtest/home/robtest
You won't be able to grant write access through some other means,
setfacl (I tried this already).
One approach that seems to work for customers is to set the default
directory. This will make the SFTP user
automatically perform a
cd uploads/ when connecting. From their perspective
(which is the
uploads/ directory), they can create files and subfolders.