Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I tried using vsftpd but the result was that my user had access to the whole filesystem.

I created a group www, changed /var/www to belong to that group and then added the new user 'ftpuser' to this group.

But when I logged the user had access to everything in the filesystem.

Is there a good and simple ftp server for linux that you guys recommend? I need to be able to easily manage permissions, like which user access which directories.



share|improve this question
The solution is to use the bind command!!! – TraderJoeChicago Jan 13 '10 at 0:49
OK, that is definitely a valid solution, but I suggest that you follow kaerast's advice and keep user's www directories in their home dir and just configure vhosts appropriately. – Vitaliy Jan 13 '10 at 17:05
up vote 3 down vote accepted

You need to make sure you configure VSFTPd to chroot that user. Look at the chroot_local_user setting. That way they will only have access to their folder.

share|improve this answer
yep, that's it. – PEra Jan 12 '10 at 18:38
But I want my users to have access to /var/www and not just to their local folder. That's the problem. – TraderJoeChicago Jan 12 '10 at 23:40

You're doing it wrong. You would be far better off creating a vhost in Apache rather than using the default /var/www. That way you can create the vhost filesystem root in /home/user/public_html. All (most?) ftp servers will default to serving a user's home directory when they login, and so you don't need to do any more configuring.

Also consider whether ftp is really the best option. FTP is insecure as it has no encryption by default - consider using scp/sftp instead. Again, you won't need to do any extra configuring because you'll be serving the users' home directory by default. And you've probably already got an ssh server running which will provide you with scp.

A good sftp/scp client for Windows is Winscp.

share|improve this answer
This still doesn't solve his problem. Unless you chroot users to their local directory, setting up vhosts won't prevent them from accessing the root directory. – Vitaliy Jan 12 '10 at 18:04
you're right, the users will be able to snoop around the rest of the server, but they if it's secured well they won't be able to do much. Plus chroot_local_user=yes is all you need to get vsftpd to chroot to a user's home directory - which requires home directories with everything you need in them. – kaerast Jan 12 '10 at 18:08
I think part of the point is you don't really want people snooping around your server. And if you need someone to have access to vhosts in a site-centric, rather than user-centric, environment then locking them into their home directory is rather pointless. – Brian Lacy Nov 5 '10 at 15:38

I don't know how to do this with VSFTPd; in fact, I tried, and gave up (I have other projects to do).

But I did have a similar problem, and the way I solved it was by forcing them to use SFTP. This can be configured through some careful modification of your OpenSSH Server configuration (/etc/ssh/sshd_config). Search for SFTP & "ChrootDirectory" and you'll find several tutorials.

A few gotchas: Your entire path to your chroot jail directory MUST be owned by root and MUST be read-only by your SFTP user(s).

If you want to give certain users access to certain sites, but you still want to manage them all in one place as the sysadmin, consider creating a separate SFTP jail (I called mine /var/www/ftp, whereas my sites live at /var/www/html) and then hard-linking the directories into the new directory with "mount --bind". Note that you must first create the individual mount directories, and that you must specify the full path to both your target directory and your mountpoint directory.

Final Note: I realize this is an old question, but if this answer had been here when I was looking earlier this week, it would have saved me two solid days of research.

share|improve this answer

I came across the same issue and found this thread marked as resolved, hope it helps :)

P.S. this one seems better.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.