Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to configure an anonymous ftp with upload. Given this requirement I try to lock this server down to the bear minimum.

One of the restrictions I wish to impose is to enable the upload of only a given set of file-names.

I tried to disallow write permission to the upload folder, and put in it some empty files with write permission:

/var/ftp/         [root.root] [drwxr-xr-x]
|-- upload/       [root.root] [drwxr-xr-x]
|   |-- upfile1   [ftp.ftp]   [--w-------]
|   `-- upfile2   [ftp.ftp]   [--w-------]
`-- download/     [root.root] [drwxr-xr-x]
    `-- ...

But this approach didn't work because when I tried to upload upfile1, it tried to delete and create a new file in its' place, and there is no permissions for that.

Is there a way to make this work, or perhaps use a different approach like abusing the deny_file option?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

OK, I have this one solved:

On /etc/vsftpd/vsftpd.conf add the line:

anon_other_write_enable=YES

From man vsftpd.conf (5):

anon_other_write_enable 

If set to YES, anonymous users will be permitted to perform write operations other than upload and create directory, such as deletion and renaming. This is generally not recommended but included for completeness.

Default: NO

Then, the ftp file layout should be:

/var/ftp/         [root.root]   [drwxr-xr-x]
|-- upload/       [root.root]   [drwxr-x--x]
|   |-- upfile1   [ftp.users]   [--w-r-----]
|   `-- upfile2   [ftp.users]   [--w-r-----]
...

The other --x permission of the upload/ directory is key here:

  • r - will allow listing the directory content
  • w - will allow creating and deleting files
  • x - will allow read/write to an existing files.

Finally, the ftp owner -w- file permissions disallows anonymous user to download that file, while local users r--, may read this file.


Please comment below if I opened myself here to some attack vector I missed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.