I need to provide multiple users FTP logins, some able to write, some only to read, to a single FTP root directory. I very much want to restrict access so that they cannot see the file system above that directory. After searching I defined the user_local config option as the root directory and confined the users to that directory using the chroot_local_users option, or chroot jail. This basically works.
Reading up, I'm finding that using chroot jail in this security context may be problematic:
Chroot jail is not secure because it only "modifies pathname lookups for a process and its children so that any reference to a path starting '/' will effectively have the new root, which is passed as the single argument, prepended onto the path" but "the current working directory is left unchanged and relative paths can still refer to files outside of the new root."
source http://lwn.net/Articles/252794/
Now this issue seems to be a problem only if the cwd is above the FTP root I assigned to the FTP users via vsftpd's Local_Root configuration parameter. What would the CWD be for the FTP daemon? Is it the one I've assigned to Local_Root? Am I right in that chroot isn't a problem, then, in my use case?
Further, I find that there are better, if difficult to implement, solutions out there, namely, that although, to quote Linux kernel developer Alan Cox, "chroot is not and never has been a security tool. People have built things based upon the properties of chroot but extended (BSD jails, Linux vserver) but they are quite different.You could probably write yourself an LSM module to do this too."
Is this method, hardening the jail concept, a standard professional approach, or do competent Linux admins simply use chroot jail? Or something else, entirely?
This question has been asked all over the Internet, but there isn't anything I've found that provides anything more than what I've included in this question. So, we find FTP downloads sites hosted by the best of the best, from the various Linux distributions to the kernel maintainers themselves. How is confining FTP users actually done securely?
