Permissions and Least Privilege on File Servers

Permissions are the security control you already own: no purchase, no agent, no vendor — just the discipline of deciding who can touch what, and encoding it so the server enforces it at every request. On a transfer server, where outside parties write into your filesystem by design, that discipline is the difference between a contained incident and a catastrophe.

This series makes permissions a designed system rather than an accumulation: the models underneath (and how transfer services map protocol users onto them), directory trees that isolate parties from each other, least privilege applied honestly, the inheritance gotchas that make uploads arrive unreadable, auditing what has drifted, and measuring the blast radius of any single stolen credential.

Articles in This Series

• Permission Models on Transfer Servers, Explained
  Classic permission bits, ACLs, and virtual-user mappings — how transfer services translate a protocol login into filesystem rights.
• Designing Directory Trees for Isolation
  Per-partner roots, inbox and outbox conventions, guarantees that partners can never see each other, and the pitfalls of shared areas.
• Least Privilege for Transfer Accounts, in Practice
  Read-only distribution, write-only drops, the case against default delete rights, and separating admin power from transfer accounts.
• Permission Inheritance and umask Gotchas in Uploads
  Why uploaded files arrive unreadable or wide-open — service defaults, umask logic, and the Windows ACL-inheritance version of the same trap.
• Auditing Who Can Touch What on Your File Servers
  Effective-permission review, hunting orphaned grants, tooling-light audit methods, and a cadence that keeps drift in check.
• The Blast Radius of One Stolen Transfer Credential
  A tabletop walkthrough: take one account, enumerate everything it reaches, then shrink that exposure structurally before an attacker runs the same exercise.

Explore More Topics

This series is part of the Sysax file transfer topic library, which covers the protocols, security practices, automation techniques, and operational skills behind reliable file transfer. The library pairs well with the practical tools we build: Sysax Multi Server, a secure FTP, FTPS, SFTP, and HTTPS server for Windows, and Sysax FTP Automation, which schedules and scripts secure transfers so the routine ones run themselves.