[PLUG] chroot perms confusion

OK. I need some help, I'm sure it's something silly I am overlooking or not understanding.

So I have a SFTP server on my DMZ for outside contractors to upload files. So I'm setting up a chroot jail, so they can only get into their own home folder.

However, I also then need to run a script as a different user, which will collect all the files into 1 ZIP file for later rsyncing, and then delete the individual files.

So what I did:

Match Group sftpusers
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no

I set up a user, stuck them in that group, and set their home folder

FileCollector@PHASFTP001:/ftp-area$ groups staples
staples : sftpusers
FileCollector@PHASFTP001:/ftp-area$

FileCollector@PHASFTP001:/ftp-area$ getent passwd staples
staples:x:1005:1006::/ftp-area/staples:/bin/bash
FileCollector@PHASFTP001:/ftp-area$

I set the perms on /ftp-root to be root:root, 755, as required by the chroot jail

FileCollector@PHASFTP001:/$ ls -la
total 64
dr-xr-xr-x. 22 root root 4096 Sep 17 16:03 .
dr-xr-xr-x. 22 root root 4096 Sep 17 16:03 ..
drwxr-xr-x. 5 root root 56 Sep 17 11:10 ftp-area

I then set the perms on their home folder to allow other members of the group to be able to write, so that my user that collects files could delete.

FileCollector@PHASFTP001:/ftp-area$ ls -la
total 4
drwxr-xr-x. 5 root root 56 Sep 17 11:10 .
dr-xr-xr-x. 22 root root 4096 Sep 17 16:03 ..
drwxrwxr-x. 3 staples sftpusers 155 Sep 22 10:33 staples

And .. nothing. I can't gt in.

C:\Temp>sftp staples@phasftp001.pha.phila.gov
staples@phasftp001.pha.phila.gov's password:
client_loop: send disconnect: Connection reset
Connection closed

So what did I do wrong or miss? I know I had this working at one point, then I tried to monkey with the group permissions, and it went all to heck.

(I'm guessing I'm gonna need to use "setfacl" to allow another user to be able to delete files out of each users home directory?)

Anyways, first things first. What do I need to do to fix the chroot jail?

Thanks

Mike. Leone, <mailto:turgon@mike-leone.com>

PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
Photo Gallery: <http://www.flickr.com/photos/mikeleonephotos>

___________________________________________________________________________ Philadelphia Linux Users Group -- http://www.phillylinux.org Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug