Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm planning on using vsftpd to act as a secure ftp server, but I am having difficulty controlling the linux users that will be used as ftp logins.

The users are required to be "jailed" into a specific directory (and subdirectories) and have full read/write access.

Requirements: - User account "admin_ftp" should be jailed to /var/www directory. - Other accounts will be added as needed, for each site... e.g: - User account "picturegallery_ftp" should be jailed to /var/www/picturegallery.com directory.

I have tried the following, but to no avail:

# Group to store all ftp accounts in.
groupadd ftp_accounts
# Group for single user, with the same name as the username.
groupadd admin_ftp

useradd -g admin_ftp -G ftp_accounts admin_ftp
chgrp -R ftp_accounts /var/www
chmod -R g+w /var/www

When I log into FTP using account admin_ftp, I am given the error message:

500 OOPS: cannot change directory:/home/admin_ftp

But didn't I specify the home directory?

Extra internets for a guide how to do this specifically for vsftpd :)

share|improve this question
    
"But didn't I specify the home directory?" Where did you specify it? Did you leave out a command? –  BMDan Feb 1 '11 at 15:42

4 Answers 4

up vote 1 down vote accepted

My first response is simple:

Don't use FTP unless you absolutely have to. It's not secure, and there's no reason in this day in age to use it.

Instead, use SSH and/or SCP and/or SFTP (all similar and related protocols).

As far as how to do it, there are a fair number of them. I'll link to a few google search results (Not vouching for any of these):

There are tons more, just search around...

share|improve this answer

Specifically for vsftpd, eh? Okay:

In vsftpd.conf, add:

user_config_dir=/etc/vsftpd/user_conf

Then in /etc/vsftpd/user_conf/admin_ftp, put:

anon_root=/var/www
local_root=/var/www

...and so on for each other account.

Now, it's worth pointing out that jailing people like this, in the absence of other safeguards, can be pointless; after all, since it's inside a DocRoot, they can just upload a PHP file, and then access that PHP file via Web browser, at which point they're no longer jailed. So remember to carefully consider the entire security environment as a whole.

As for security of the FTP conversation itself (ircmaxell's concern), just set up FTPS. It's pretty trivial to do so in vsftpd, and if you use FTPES, you can connect either way.

share|improve this answer

How about setting local home for those accounts accordingly and then use chroot with chroot_local_user or chroot_list_enable config options?

share|improve this answer

when you created the admin_ftp user you did not specify that you want the home for this user to be anything other than /home/admin_ftp. so the ftp server is trying to go into the /home/admin_ftp because that's what it sees in the passwd file. you should change the home directory for the admin_ftp to /var/www/ if you want that to be the directory you go into when you FTP using that user:

usermod -d /var/www admin_ftp

i don't know what distribution you use but Arch linux has a good wiki page on setting up vsftp: Very Secure FTP Daemon

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.