Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Pure-FTPD on centos 5 with cPanel installed.

When somebody upload a symlink file called 1.txt and it's a symlink to /partition for example, He can browse all /partition contents from this symlink through Pure-FTPD and it's a dangerous security problem.

How can i solve this security issue and disable symlinks browing on FTP .?

share|improve this question
add comment

1 Answer

You haven't set up chroot feature in 'pureftpd' configuration. Once your users will be 'chrooted', they will not be able to go outside from their home directories.

Additional info:

http://download.pureftpd.org/pub/pure-ftpd/doc/README

http://download.pureftpd.org/pub/pure-ftpd/doc/FAQ

share|improve this answer
    
ChrootEveryone directive is set to yes in my prue-ftpd.conf –  Linux Intel Jul 26 '12 at 22:40
    
@LinuxIntel Probably, your pureftpd instance has been built with virtualchroot option: " --with-virtualchroot: usually, when a user is chrooted (-A and -a options), it's impossible to go out of his home directory. Enabling that feature makes it possible: symbolic links are always followed, even if they are pointing to directories not located in the user's home directory. This is very useful for having shared directories (for instance, have a symbolic link to /var/incoming in every home directory). This feature isn't enabled by default." –  Denis Jul 26 '12 at 22:59
    
pure-ftpd is installed by default on cPanel, And i can not find the complie parameters. How can i know virtualchroot is disabled or enabled .? –  Linux Intel Jul 26 '12 at 23:37
    
@LinuxIntel you can check the options which it has been built with downloading according SRPM and looking through the spec. –  Denis Jul 26 '12 at 23:39
    
unfortunately i can not find the compile parameters, But i add this VIRTUALCHROOT false into my pure-ftpd.com and the symlinks still working. –  Linux Intel Jul 27 '12 at 1:10
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.