File acls (setfacl) not working how I would expect them to

I have a basic SFTP server setup using OpenSSH. To setup the SFTP server, I followed these steps:

Step 1: I installed the OpenSSH package.

sudo apt-get install openssh-server -y

Step 2: Created separate group for SFTP users.

sudo groupadd sftpaccess

Step 3: I edited the /etc/ssh/sshd_config file by finding Subsystem sftp /usr/lib/openssh/sftp-server and commnting it out. After that I went to the very bottom of the file and added this:

Subsystem sftp inteal-sftp
Match group ftpaccess
ChrootDirectory %h
X11Forwarding no
AllowTcpForwarding no
ForceCommand inteal-sftp

Step 4: Restarted the sshd service.

sudo /etc/init.d/ssh restart

Step 5: Added User with sftpaccess group and create password

useradd -s /bin/bash -m -U -G sftpaccess sftp-alex
passwd sftp-alex

Step 6: Create and Modify user directory.

sudo mkdir -p /mnt/users/sftp-alex/www
sudo chown root:root /mnt/users/sftp-alex
sudo chown root:sftpaccess /mnt/users/sftp-alex/www

My goal (The thing that is stumping me):

1. I want to create a directory here (/mnt/www) for something like a user share and then bind that to /mnt/users/sftp-alex/www so it would look something like this:

   • Making the user share: mkdir /mnt/www
   • Binding share to users mount --bind /mnt/www /mnt/users/sftp-alex/www

2. The next thing in this process is to create a sharing system/permissions system. My thought on how to do this is pretty straightforward in execution. I want to create two groups, one called sftp_read_write and the other one called sftp_read now if you can't already tell where I am going with this then let me explain. I am going to be using setfacl to add acls to files and folders. My thought was something like this setfacl -Rm g:sftp_read_write:rwX,g:sftp_read:rX /mnt/www. Now this is all great and all but it does not work I can read and write whether I am in sftp_read_write or sftp_read or sftpaccess

I really need help figuring this out I have gotten a setup like this to work before, which was about a year ago but I have forgotten all of the commands/permissions which is why I am asking this question.

Thanks, Alex

Recent Questions...