sftp restricted access to a directory

Question

I need to grant access via SFTP to a specific folder with full write permissions from the root of this folder. I made it work but can't figure out a way to provide write permission on the / of the root.

I read that the common way to solve this is just to create a subfolder for each user but this one contains existing files which are used all around the website.

In short :

/ should not be readable (this is correct)
/uploads/ is not writable (**but should** by any means)
/uploads/* is writable (and should)

This is what I have done so far :

/var/www/uploads is owned by root:root with 755 permissions. (775 prevents user to even log in)
/var/www/uploads/* is owned by newuser:sftp 775 permissions.

relevant /etc/ssh/sshd_config

Match group sftp
   ChrootDirectory %h
   AllowTcpForwarding no
   X11Forwarding no
   ForceCommand internal-sftp

AllowGroups ssh-users sftp

users are created like this :

useradd -d /var/www/uploads -m newuser -g sftp -s /bin/false

Thank's a lot!

Answer 1

I made it work but can't figure out a way to provide write permission on the / of the root.

It is not possible. The chroot directory can not be writtable by the user you are chrooting. That is a must defined in the manual page for sshd_config:

At session startup sshd(8) checks that all components of the pathname are root-owned directories which are not writable by any other user or group.

Answer 2

Directories shared between users on a system should have permissions that cover access for all the users.

I tend to use 1777 on the shared directory and contents. It gives all users full access while preventing deletion by other than the files' owner.

The preceding 1 in the permission octal is the sticky bit that narrows deletion and permission change rights to the owner.