I'm running Pure-FTPD on centos 5 with cPanel installed.
When somebody upload a symlink file called 1.txt and it's a symlink to /partition for example, He can browse all /partition contents from this symlink through Pure-FTPD and it's a dangerous security problem.
How can i solve this security issue and disable symlinks browing on FTP .?
You haven't set up chroot feature in 'pureftpd' configuration. Once your users will be 'chrooted', they will not be able to go outside from their home directories.
Additional info:
pureftpd instance has been built with virtualchroot option: " --with-virtualchroot: usually, when a user is chrooted (-A and -a options), it's impossible to go out of his home directory. Enabling that feature makes it possible: symbolic links are always followed, even if they are pointing to directories not located in the user's home directory. This is very useful for having shared directories (for instance, have a symbolic link to /var/incoming in every home directory). This feature isn't enabled by default."
pure-ftpd is installed by default on cPanel, And i can not find the complie parameters. How can i know virtualchroot is disabled or enabled .?
Jul 26, 2012 at 23:37
VIRTUALCHROOT false into my pure-ftpd.com and the symlinks still working.
Jul 27, 2012 at 1:10