How to setup SFTP directory with "Upload files" ONLY ?

[yyghp]

How to setup SFTP directory with "Upload files" ONLY ?

I have SSH service running on HP-UX 11.11, users want to access one directory via SFTP. They can only upload files to that directory, that is, ADD files, but they can't REMOVE or UPDATE those files under that directory.
Is that possible? If yes, how?
( as I know, if I give user the permission to WRITE to that directory, "drwx------", then they can not only add files, but also change the name of the file, remove the file... )
Thanks!

[Simon Hargrave]

Are they uploading as one username, or different users?

You can set the sticky bit on the directory which will stop people deleting files owned by other users, but if you want to stop anyone deleting any files you really want a batch job that will move them out of the upload directory on a regular basis.

A loop that performs an fuser on a file to ensure it's not open (and therefore isn't mid-copy), then mv it to another directory.

[yyghp]

I will setup one generic account for the user. The directory is either owned by this user or other user( if owned by other user, for example: oracle, such generic account can access via group permission ).

What's sticky bit?

Thanks!

[Simon Hargrave]

To set the sticky bit on a directory, you use:

chmod 1777 dir

The permissions will look like

drwxrwxrwt

The t is the sticky bit. Basically it means that, even though the directory can be changed by anyone, it forces that ONLY the owner of the directory or the file can change/delete the file.

However since you have only 1 user it will not help in this case.

You will need to use the scripted moving I suggested earlier.

[yyghp]

Thanks Simon!

Is there any other option to let the owner of the directory to add files to that dir only, but no delete files allowed?
I don't think the batch job solution can fit my case well, but thanks anyway.

[Steven E. Protter]

If you are careful with ownership, read and write permissions you can pull this off.

You may need to add a cron program that runs every few minutes and uses root to change the permissions on new files so that once uploade the users can't do anything like delete them.

That program will probably need to run once a minute but won't be that cpu intensive.

I suppose given some more time, I could design it further, let me know.

SEP