I could use a pointer. I have this server on my DMZ, we use it for vendors and others to upload/download files. This is all via SFTP, and I have it all set up as a chroot jail. That part is working fine.
But what we do is, we have a host on the protected LAN, reaches into the DMZ onto that host, runs a script that is stored on the DMZ host which aggregates all of the uploaded files, and then we rsync them back into the protected LAN and process them. Been working fine for literally more than 15 years (I originally wrote it in 2010, with a bunch of hep from this list).
Difference is, now we've turned the DMZ host into a chroot jail - before it wasn't chrooted. (Bad, I know, hence why we're trying to change it now. Better late than never)
And executing the script from the protected LAN isn't working anymore.
On the DMZ host, I can execute the script locally (i.e., logged into the DMZ host) it does what it's supposed to do, it aggregates the files that all the other users uploaded, and sticks a copy where it's supposed to.
But it doesn't work if I do try to execute the script remotely, via SSH.
And I'm sure it's something simple I'm just overlooking.
If I try to execute the script remotely, over SSH using pre-shared keys, I get:
Now, /PHA-Scripts/snag-files.sh does exist on the target phasftp001 server, owned and operated by that FileCollector account I am trying to execute it with.
ls -la
drwxrwxr-x. 3 FileCollector FileCollector 172 Sep 17 15:41 PHA-Scripts
FileCollector@PHASFTP001:/$ ls -la /PHA-Scripts/
total 32
drwxrwxr-x. 3 FileCollector FileCollector 172 Sep 17 15:41 .
dr-xr-xr-x. 22 root root 4096 Sep 17 16:03 ..
drwxr-xr-x. 2 FileCollector FileCollector 59 Jan 9 2026 'Backup to Networker'
-rw-r--r--. 1 FileCollector FileCollector 4453 Jan 12 2026 snag-files.sh
-rw-r--r--. 1 FileCollector FileCollector 3936 Jul 22 2010 snag-files.sh~
If I SSH directly over to that server as that FileCollector account, I can execute the script.
Web console: https://PHASFTP001:9090/ or https://192.168.2.101:9090/
Register this system with Red Hat Lightspeed: rhc connect
Example:
# rhc connect --activation-key <key> --organization <org>
The rhc client and Red Hat Lightspeed will enable analytics and additional
management capabilities on your system.
View your connected systems at https://console.redhat.com/insights
You can learn more about how to register your system
using rhc at https://red.ht/registration
Last login: Thu Sep 17 16:07:41 2026 from 192.168.2.1
FileCollector@PHASFTP001:~$ cd /PHA-Scripts/
FileCollector@PHASFTP001:/PHA-Scripts$ ls -la
total 32
drwxrwxr-x. 3 FileCollector FileCollector 172 Sep 17 15:41 .
dr-xr-xr-x. 22 root root 4096 Sep 17 16:03 ..
drwxr-xr-x. 2 FileCollector FileCollector 59 Jan 9 2026 'Backup to Networker'
-rw-r--r--. 1 FileCollector FileCollector 4453 Jan 12 2026 snag-files.sh
-rw-r--r--. 1 FileCollector FileCollector 3936 Jul 22 2010 snag-files.sh~
FileCollector@PHASFTP001:/PHA-Scripts$ sh snag-files.sh
Directory Tree: /ftp-area/
Existing ZIP File, if any: /home/FileCollector/snagged-files/snagged_2026-09-17_16:14:46.zip
And here we go
Looking for files newer than [/home/FileCollector/snag_files.last_run]
And now on to process the file(s), if any
Here are the files I've found [ ]
Please to be checking /home/FileCollector/snagged-files for any new ZIPped files.
(yes, that is the output to be expected from the script, as there are no new files to snag and make into a ZIP, which I will later rsync inbound)
So that FileCollector account can execute the script, just not over the SSH pre-shared keys.
So what concept am I missing here? Why am I getting "bash: line 1: /PHA-Scripts/snag-files.sh: Permission denied" when trying to execute this script as this same user, only this time over the SSH?
Thanks
--