Jail Linux user to directory for FTP login

Question

I'm planning on using vsftpd to act as a secure ftp server, but I am having difficulty controlling the linux users that will be used as ftp logins.

The users are required to be "jailed" into a specific directory (and subdirectories) and have full read/write access.

Requirements: - User account "admin_ftp" should be jailed to /var/www directory. - Other accounts will be added as needed, for each site... e.g: - User account "picturegallery_ftp" should be jailed to /var/www/picturegallery.com directory.

I have tried the following, but to no avail:

# Group to store all ftp accounts in.
groupadd ftp_accounts
# Group for single user, with the same name as the username.
groupadd admin_ftp

useradd -g admin_ftp -G ftp_accounts admin_ftp
chgrp -R ftp_accounts /var/www
chmod -R g+w /var/www

When I log into FTP using account admin_ftp, I am given the error message:

500 OOPS: cannot change directory:/home/admin_ftp

But didn't I specify the home directory?

Extra internets for a guide how to do this specifically for vsftpd :)

Answer 1

My first response is simple:

Don't use FTP unless you absolutely have to. It's not secure, and there's no reason in this day in age to use it.

Instead, use SSH and/or SCP and/or SFTP (all similar and related protocols).

As far as how to do it, there are a fair number of them. I'll link to a few google search results (Not vouching for any of these):

• IT.Toolbox
• Another Blog
• Yet another tutorial using JailKit
• nixCraft Article
• A tutorial for Debian

There are tons more, just search around...

Answer 2

Specifically for vsftpd, eh? Okay:

In vsftpd.conf, add:

user_config_dir=/etc/vsftpd/user_conf

Then in /etc/vsftpd/user_conf/admin_ftp, put:

anon_root=/var/www
local_root=/var/www

...and so on for each other account.

Now, it's worth pointing out that jailing people like this, in the absence of other safeguards, can be pointless; after all, since it's inside a DocRoot, they can just upload a PHP file, and then access that PHP file via Web browser, at which point they're no longer jailed. So remember to carefully consider the entire security environment as a whole.

As for security of the FTP conversation itself (ircmaxell's concern), just set up FTPS. It's pretty trivial to do so in vsftpd, and if you use FTPES, you can connect either way.

Answer 3

How about setting local home for those accounts accordingly and then use chroot with chroot_local_user or chroot_list_enable config options?

Answer 4

when you created the admin_ftp user you did not specify that you want the home for this user to be anything other than /home/admin_ftp. so the ftp server is trying to go into the /home/admin_ftp because that's what it sees in the passwd file. you should change the home directory for the admin_ftp to /var/www/ if you want that to be the directory you go into when you FTP using that user:

usermod -d /var/www admin_ftp

i don't know what distribution you use but Arch linux has a good wiki page on setting up vsftp: Very Secure FTP Daemon