Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm running Ubuntu 10.04 i386. I use Cyberduck (FTP GUI client) to connect to my server mysub.domainname.com (changed here).

This is what I want to be able to do:

1) Change apache2 root from /var/www to /home/myuser/webroot to serve files like index.html

2) Allow FTP to write in /home/myuser/webroot

3) Allow myuser to login with his user/pass combo with FTP and read/write anywhere within myuser folder

Apache2 root folder works fine. Going to myserver.com/index.html works. But I can't get FTP to write, even though I changed these lines in etc/vsftpd.conf:

listen=YES
#listen_ipv6=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
#local_umask=022
#anon_upload_enable=YES
#anon_mkdir_write_enable=YES
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
#chown_uploads=YES
#chown_username=whoever
#xferlog_file=/var/log/vsftpd.log
#xferlog_std_format=YES
#idle_session_timeout=600
#data_connection_timeout=120
#nopriv_user=ftpsecure
#async_abor_enable=YES
#ascii_upload_enable=YES
#ascii_download_enable=YES
#ftpd_banner=Welcome to blah FTP service.
#deny_email_enable=YES
#banned_email_file=/etc/vsftpd.banned_emails
# chroot_list_enable below.
#chroot_local_user=YES
#chroot_local_user=YES
#chroot_list_enable=YES
#chroot_list_file=/etc/vsftpd.chroot_list
#ls_recurse_enable=YES
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/private/vsftpd.pem

The problem

Whenever I try to create a folder in /home/myuser or /home/myuser/webroot I get error Create directory operation failed. in my FTP program, Cyberduck.

Maybe helpful info:

drwxrwsr-x 2 myuser www-data 4096 2011-04-18 03:04 webroot

and I changed the permissions here too:

-rw-rwSr-- 1 myuser root 69 2011-04-18 02:14 index.html

...BUT no luck. I still can't upload or write using FTP. Any suggestions or pointers would be great, I'm pretty squarely lost on this one.

UPDATE:

I tried enabling anonymous logins for FTP, and I could not even get that to work...I think the only solution is to completely purge system of vsftpd and apache2 and just start over

share|improve this question
    
Good question. All the walkthroughs I find online are for virtual users rather than normal local users, so it seems that what you have should work. What happens if you try uploading to a world-writable directory like /tmp ? If it works, who owns the file? –  DerfK Apr 18 '11 at 22:38
    
When I upload a file to /tmp, say "something.js" using Cyberduck logged in as myuser, it does work. The file is owned by myuser. –  lollercoaster Apr 18 '11 at 22:45
    
@lollercoaster might be SELinux. What does ls -ldZ /home/myuser/webroot/ say, and do you have any relevant messages in /var/log/audit.log? –  DerfK Apr 18 '11 at 23:25
    
root@myserver:/# ls -ldZ /home/myuser/webroot ls: cannot access /home/myuser/webroot: No such file or directory –  lollercoaster Apr 18 '11 at 23:32
    
and no messages in /var/log/audit.log in fact there is no such file on my machine –  lollercoaster Apr 18 '11 at 23:34

1 Answer 1

up vote 1 down vote accepted

For permissions, you need to have the folder and files in it owned by myuser so that they can be accessed from the myuser account.

If apache (or your scripts) needs to write to the folder, then the best thing to do is use chgrp to assign the specific locations that should be written to to the www-data group, then chmod g+w that location or file. If you are giving write access to a folder, chmod g+sw will give write access to the folder and ensure that files created there will also belong to the www-data group.

The files and directories in this case would look something like:

drwxrwxr-x 2 myuser   www-data    4096 2011-04-18 03:04 webroot
-rw-rw-r-- 1 myuser   www-data    1000 2011-04-18 03:04 index.html
drwxrwsr-x 2 myuser   www-data    4096 2011-04-18 03:04 folderwithg+ws

You would want to be very careful giving write access to files and folders to apache though, otherwise an attacker might figure out a way to make your scripts overwrite themselves or replace index.html, or whatever.

Otherwise, if apache does not need to write to your document directory, the permissions should be fine as it is long as all of the subdirectories and files are world readable (and directories are world accessible).

For SSL/TLS, you're missing

ssl_enable=YES

You can force users to use encryption:

force_local_logins_ssl=YES
force_local_data_ssl=YES

And there is a ssl_ciphers= option as well, if you want to limit it to HIGH or a specific list of ciphers. If you want "implicit SSL" (instead of AUTH SSL or AUTH TLS commands to start encryption, the encryption is negotiated at the beginning of the connection) then that is implicit_ssl=YES

share|improve this answer
    
OK, cool. So given that the webroot folder is owned by root and www-data as seen here: root@myserver:/home/myuser# ls -l returns drwxr-xr-x 2 www-data root 4096 2011-04-18 03:04 webroot - then I should change ownership using chown myuser webroot. but that is still confusing, can I have both www-data and myuser still have ownership? I want to have the myuser folder and all of its subdirectories read/write capable for BOTH Apache and FTP. Is that possible? –  lollercoaster Apr 18 '11 at 23:52
    
@loller www-data is the owner, root is the group. Standard Unix permissions are based on owner, group, then everyoneelse. If the folder is owned by "myuser" and the first set of "rwx" is enabled, then myuser has read write and access/execute permissions. If you change the group to www-data (ubuntu's default apache group) then use the chmod command I gave to enable group write access (second set of "rwx" is enabled (x will be "s" if you used g+sw)) then apache, being a member of www-data group, will be able to write to it. –  DerfK Apr 19 '11 at 0:13
    
not working. I'll update my original post to be clearer. I'm really not sure what the problem is - I still can't upload with FTP or create files –  lollercoaster Apr 19 '11 at 2:47
    
I wonder if it thinks you're using virtual users? I can't really find a guide that explains what makes virtual users with PAM different from local users with PAM... try virtual_use_local_privs=YES –  DerfK Apr 19 '11 at 4:03
    
hmmmm. good thought, but it didn't seem to work either. –  lollercoaster Apr 19 '11 at 5:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.