How does a vsftpd server work and how to configure it?

Question

I was asked to configure a FTP server, based on the vsftpd package. The server is running on a remote machine to which I have a superuser privilege access.

Being unfamiliar with the mechanics of FTP servers, I tried to figure out how user ftp accounts are configured. The previous maintainer used a shell script, which works on a list that we maintain to track users accounts and passwords, to configure the ftp accounts. From reading the script, I see that he generates a list of usernames and passwords, and actually creates a user account on the Linux machine. This means that for each user that we configure in the list, a new user account is being added by the adduser command:

adduser --home /home/ftp --no-create-home $user

(but w/o a private /home/username directory - using the /home/ftp instaed).

Each of these users can log into his account using the ssh command. This fact seems a little strange to me, as I'd think that the ftp account should be decoupled from the Ubuntu user accounts.

As another side effect, when a user connects using a web browser, he is connected to the /home/ftp directory. However, he can then use "Up to a higher level directory" link to go up and effectively have access to all of our system.

So, the questions are:

1. Is this really how the FTP server supposed to work in terms of configuring ftp accounts?

2. If not, how do I configure the vsftpd server in a way that I have only the superuser Ubuntu account on that machine and all ftp account are... just FTP user accounts? Additionally, these ftp account should be configured in terms of how and what they are allowed to access.

Answer 1

Definitely the previous admin did't do a good job.

So first of all if you add the following lines in your vsftpd.conf you will chroot users in their home directory.

chroot_list_enable=YES
chroot_local_user=YES

# a list of users which are NOT to be placed in a chroot() jail
chroot_list_file=/etc/vsftpd/chroot_list

For managing users you can create virtual one (have a look here), but if you think that solution is too complex just use pam_listfile.so module to deny ftp users the ssh access or use pam_shells.so. Whichever is easier for you. Just be careful not to block the ssh server to valid users :)

Answer 2

Sounds like you need a chroot'ed ftp server with non-system users, I think this wiki howto has the answers you need.

Answer 3

You should use virtual users as FTP users.

Follow this post: http://howto.gumph.org/content/setup-virtual-users-and-directories-in-vsftpd/