0

So is setting up an ftp user really just setting up a user in ubuntu? I saw something about setting up a user without a home directory. What other things are important? I'd like to give the user the least amount of privilege possible. They only need access to /var/www/example.com and everything beneath it. So I'd like when they log in to ftp that they can only see that (not see any other folders/files). I'm using vsftpd if that matters.

1 Answer 1

2

Well, if you are really concerned about security, then I would recommend not to use FTP at all and go with SCP (WinSCP is an excellent Windows client for that, and FileZilla also supports it). For that to work, all you need to do is add the new user, and point his/her home directory to /var/www/example.com/

Under Ubuntu, if they log in using SSH, you can hardly prevent them from seeing other things, but you can remove their entry in /etc/sudoers (using visudo), which will prevent them from doing anything.

I would further recommend to disable plain password logins and generate keys for all user accounts. There are numerous articles on the Internet on how to do this.

If you really want to use vsftpd, then do this:

  1. Add the user (using adduser or useradd). Make sure they are all in the same group (e.g.users), use the option -s /etc/ftponly
  2. Add the username to the file /etc/vsftpd/chroot_list
  3. Execute touch /etc/vsftpd/user_conf/username (this is a workaround for some funny stuff in vsftpd)

This works together with:

  1. Anonymous access disabled (in /etc/vsftpd/vsftpd.conf)
  2. The chroot_list option enabled and pointing at the above mentioned file
  3. Having user specific config dirs

In fact, you probably want to have the following options in the config file:

nopriv_user=ftp
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list
passwd_chroot_enable=YES
pam_service_name=vsftpd
userlist_enable=YES
user_config_dir=/etc/vsftpd/user_conf

More info can be found in the man page for vsftpd.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .