0

I have been trying for ages to get this to work, to no avail.

I have a VSFTPD server running on Arch. It works fine EXCEPT that users can navigate up the directory tree and view/download files in other user's home directories. I figure that the answer lies in chroot() but every iteration of the configuration I've tried doesn't work (and yes, I've been restarting the server each time). I'm not sure if the problem lies within the VSFTPD conf or the shell script I use to create new users. I would really appreciate any help with this.

So, here is my conf:

listen=YES
anonymous_enable=NO
dirmessage_enable=YES
chmod_enable=NO
log_ftp_protocol=YES
pasv_enable=YES
pasv_min_port=xxxxx
pasv_max_port=xxxxx
pasv_address=xxx.xxx.xxx.xxx
xferlog_enable=YES
connect_from_port_20=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=NO
idle_session_timeout=600
data_connection_timeout=120
ftpd_banner=xxxxx xxxxx
pam_service_name=ftp
local_umask=022
chroot_local_user=NO
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.userlist
passwd_chroot_enable=YES
local_enable=YES
write_enable=YES
force_dot_files=NO
tcp_wrappers=NO
userlist_enable=YES
userlist_deny=NO
userlist_file=/etc/vsftpd.userlist

Here is a shell script I run to create a new user:

#!/bin/sh
mkdir /home/./$1
chmod 775 /home/./$1
useradd -d /home/./$1 -s /bin/false $1
chown -R $1 /home/./$1
passwd $1
echo $1 >> /etc/vsftpd.userlist
echo "FTP user created."

4 Answers 4

8

I had the same problem. No chroot, you could see all the files. When I allow chroot I can't log in my ftp server.

How did I resolve it? Appended this to configuration file:

allow_writeable_chroot=YES

http://www.benscobie.com/fixing-500-oops-vsftpd-refusing-to-run-with-writable-root-inside-chroot/

1
  • it worked for me May 5, 2018 at 9:35
3

It is an old thread I know. Had the same problem using debian wheezy on a Raspberry Pi and found out that everytime during login automatically the sftp-server became active (checked via ps -ef).

Disabled the server in sshd_config by changing the command into:

Subsystem sftp /bin/false

and got correct logins via the vsftp server using TLS. Chroot jail worked correct now.

1

Does root own the directories which any given user is 'chrooted' to? I believe this is a requirement in the newest VSFTPD versions.

If you can't change ownership of these folders to root, then try out proftpd.

1
  • Yep, this was the issue I had. change chroot jail dir to root ownership and all working
    – doz87
    Jul 16, 2021 at 11:47
0

The configuration looks fine to me. In fact I just tested it in CentOS 6.3 and vsftpd: version 2.2.2, it worked without a problem. The user was jailed to their home directory. I had an issue with SELINUX and resolved it by setting setsebool ftp_home_dir on. Your shell script though caused a problem. In /etc/passwd, it set the home directory of the user to /home/./username instead of /home/username.

My suggestion is to first try adding a user with a one-liner useradd -d /home/userftp -s /bin/false userftp, set a password and add the user to /etc/vsftpd.userlist.

1
  • thanks for the reply. I tried the one-liner and got this Cmd: USER blaman 331: Please specify the password. Cmd: PASS xxxxxxxx Unexpected response: OOPS: cannot change directory:/home/blaman 500: OOPS: cannot change directory:/home/blaman Cmd: QUIT 500: OOPS: priv_sock_get_cmd. Also, reading the docs, I thought the /./ denoted where the jail was?
    – MFB
    Feb 18, 2013 at 4:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .