remote open("/file"): Permission denied

[stefanocog]

I login correctly to container with the command sftp -P 2222 user@ip_container
To sftp shell i get this error:

sftp> put file.sh 
Uploading file.sh to /file.sh
remote open("/file.sh"): Permission denied

I have run the container with docker-compose:

sftp:
 image: atmoz/sftp
 volumes:
  - /host/sftpdata:/home/sftp/share
 ports:
  - "2222:22"
 command: sftp:password:1001

[atmoz]

Each user is jailed in their home directory (for security). That means root is owning the home directory, and the user can not modify it's content. The user can only do changes inside sub-directories.

You have to create a directory (i.e. mount a volume) inside the user's home directory, and then you can upload files there. In your case, this will be the "share" directory.

[cthiebault]

Here is a way to configure automatically the creation & permissions for a share folder:
it will create a share folder for every users with a home folder and change ownership to the proper user.

docker-compose.yml

  sftp:
    image: atmoz/sftp
    volumes:
      - ./users.conf:/etc/sftp-users.conf:ro
      - ./init.sh:/etc/sftp.d/init.sh:ro

init.sh

#!/bin/bash
for user_home in /home/* ; do
  if [ -d "$user_home" ]; then
    username=`basename $user_home`
    echo "Setup $user_home/share folder for $username"
    mkdir -p $user_home/share
    chown -R $username:users $user_home/share
  fi
done

[knutole]

I'm having the same problem. I find the documentation a bit lacking. Why is this not enough:

docker run \
    -v /home/SFTP/malnes/share:/home/malnes/share \
    -p 2222:22 -d atmoz/sftp \
    malnes:randompassword:1001

Logging into the SFTP account, the user is not allowed to put files in either / or /share. Shouldn't this work out of the box?

Should the /home/SFTP/malnes/share folder be created on host? (I have, with 666 permissions.)

Intuition fails me here.

[atmoz]

This is the nature of file permissions and volumes. They have to match if you want it to work as you expect. I will have a closer look at this challenge soon, and will add more to the documentation, so fewer people fall into this pit.

[knutole]

Thanks @atmoz, I think that would be great.

[ianlshaw]

I ran into this also. For me, it was failing to pass in the subdirectory name as an argument to the container COMMAND.

In the above examples I see malnes:randompassword:1001
Which does not reference the subdirectory.

Here's the line which sorted out the permissions issue for me.
command: foo:pass:::upload

I'm using a shared volume, so have omitted the group identification mapping.

For reference, here's my volume line from the sftp service declaration:

 volumes:
        - data-volume:/home/foo/upload

[Vizy-CC]

啊

[Vizy-CC]

啊

[Vizy-CC]

@ #86

• fads 风f
  撒
• [ ]

[Drachenfels]

I will allow myself to note that part about permissions is yet to be clarified in main README.md. From perspective of semi-noob as a devops it easy to fail on that front I would suggest modyfing following paragraph of README.md:

Let's mount a directory and set UID:

docker run \
    -v /host/upload:/home/foo/upload \
    -p 2222:22 -d atmoz/sftp \
    foo:pass:1001

Into:

Let's mount a directory and set UID:

docker run \
    -v /host/upload:/home/foo/upload \
    -p 2222:22 -d atmoz/sftp \
    foo:pass:1001

NOTE: If upload fails due to "No such file or director" or "Permission denied" make sure that /host/upload is owned by same user as docker container is run by. Common scenario is that this directory is owned by root while docker is run by current $USER.

With sentence like that it will save a noob or two out there. ;-)