Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm setting up on my VPS a vsftpd, and i don't want users be allowed to leave they're ftp home directory. I'm using local_user ftp, not anonymous, so I added:

chroot_local_user=YES

I've read in a lot of forum post, that this is unsecure.

  1. Why is this unsecure?
  2. If this is unsecure because of using ssh to join to my VPS as well, then I could just lock out these users from sshd, right?
  3. Is there an other option for achiving this behaviour of vsftpd? ( I dont want to remove read permissions on all folder/files for "world" on my system )
share|improve this question

2 Answers 2

up vote 8 down vote accepted

Check here for VSFTPD's FAQ for the answer your looking for. Below is the important excerpt that I think will answer your question.

Q) Help! What are the security implications referred to in the
"chroot_local_user" option?
A) Firstly note that other ftp daemons have the same implications. It is a
generic problem.
The problem isn't too severe, but it is this: Some people have FTP user
accounts which are not trusted to have full shell access. If these
accounts can also upload files, there is a small risk. A bad user now has
control of the filesystem root, which is their home directory. The ftp
daemon might cause some config file to be read - e.g. /etc/some_file. With
chroot(), this file is now under the control of the user. vsftpd is
careful in this area. But, the system's libc might want to open locale
config files or other settings...
share|improve this answer
    
Thanks for that, I didn't know all that myself. Learned something! +1 –  Yanick Girouard Feb 22 '12 at 22:00

The problem is that you can't both use local accounts and also disable those accounts from shell login. If you set their login shell to /bin/nologin, it won't let you login with vsftpd either.

A better and more secure FTP daemon would be Pure-ftpd. Look it up, it's available from the EPEL repository, and it allows to create virtual users. The server uses a common user/group to set all permissions for the home folders of the users and "maps" the virtual users to that user when it logs in to deal with permissions. That's more secure, and you don't have to deal with openssh login security.

Pure-ftpd also supports a whole lot of features such as quotas, ratios, and such. Much better than vsftpd.

Here's a simple tutorial on how to install it and configure a basic virtual user: http://blog.namran.net/2011/05/04/how-to-setup-virtual-ftp-server-using-pure-ftpd-in-centos/

If you read the full doc (which you should) you'll know that the -d switch when creating the virtual user is an auto-chroot to that directory for that user.

share|improve this answer
    
I use the AllowUsers user1 user2 directive in my sshd_config, where i don't allow the ftp_user1 to login with ssh, still user ftp_user1 is able to login with ftp. So it's working as intented, but still my main question open, why is it unsecure? –  burninggramma Feb 22 '12 at 14:11
    
Yes it will! You just need to add the "non-shell" to /etc/shells. On many systems either /bin/false or /bin/nologin exists in /etc/shells. If the shell is there, vsftpd will indeed let you login, also with chroot_local_user enabled. –  Frands Hansen Feb 22 '12 at 19:47
    
I stand corrected then. Thanks for pointing it out! –  Yanick Girouard Feb 22 '12 at 21:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.