Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to periodically give temporary and limited access to various directories on a CentOS linux server that has vsftp installed.

I've created a user using useradd [user_name] and given them a password using passwd [password].

I've created a directory in /var/ftp and then I bind this to the directory that I wish to limit access to.

What else do I need to specifically do to ensure that when this user logs into FTP, they only have access to this directory please?

share|improve this question
    
Sorry but have you ever considered to check vsftpd.conf? –  Jiri Xichtkniha Oct 9 '13 at 12:21
    
Yes. I have. It doesn't tell me how to instruct a specific user to log in to a specific directory...? –  zigojacko Oct 9 '13 at 12:30
1  
Sure? chroot_list_enable option... Or you mean to override directory different than $HOME? –  Jiri Xichtkniha Oct 9 '13 at 12:34
    
I want to know how to declare a specific home directory for a specific user. I've enabled chroot_list_enable and created /etc/vsftpd/chroot_list. I just didn't know what to do next. –  zigojacko Oct 9 '13 at 13:09
    
Then usermod to change user's homedir. –  Jiri Xichtkniha Oct 9 '13 at 13:11

1 Answer 1

up vote 1 down vote accepted

Complete answer that solved my question for any others that are after a step by step walkthrough...

Install vsftpd using this as a guide.

  • Create user with useradd [user_name].
  • Create user's password with passwd [user_name]. (You'll be prompted to specify the password).
  • Create FTP directory in /var/ftp and then bind to the 'home' directory you wish to specify for this user with mount --bind /var/www/vhosts/domain.com/ /var/ftp/custom_name/.
  • Change user's home directory with usermod -d /var/ftp/custom_name/ user_name

    In /etc/vsftpd/vsftpd.conf, ensure all all of the following are set:-

    • chroot_local_user=YES
    • chroot_list_enable=YES
    • chroot_list_file=/etc/vsftpd.chroot_list

Only list users in the vsftpd.chroot_list file if you want them to have full access to anywhere on the server. By not listing them in this file, you're saying restrict all vsftpd users to their specified home directory.

In other words (for reference):-

  1. means that by default, ALL users get chrooted except users in the file...
    • chroot_local_user=YES
    • chroot_list_enable=YES
  2. means that by default, ONLY users in the file get chrooted...
    • chroot_local_user=NO
    • chroot_list_enable=YES
share|improve this answer
    
Why not setting the home directory of that user directly to /var/www/vhosts/domain.com/? Is there some problem with that (like any potential risks)? –  leemes Aug 7 at 19:12
    
I just found out that vsftp seems to forbid to grant an ftp user write permissions on the chroot top level for security reasons (but I'm not 100% sure). So that might be a reason to have this "indirection" in order to grant the ftp user write access to a specific folder while not allowing to view any sibling folder (which would be the case if you simply set his home one level up, which avoids the mentioned issue). (see ubuntuforums.org/…) –  leemes Aug 7 at 21:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.