Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to allow broad anonymous download access via vsftpd, but restrict uploads to only a single path. Is there any way to do this is other than with the filesystem permissions?

There are two main problems with trying to lock down the filesystem:

  1. It affects all users -- this is a heterogeneous system, so it's difficult to ensure everyone except the FTP user has access.
  2. It doesn't appear to be hierarchical -- even if we can lock down the top-level directories, it seems easy for someone to create an FTP-writeable subdirectory, at which point vsftpd appears to happily allow things to be uploaded to it.

Right now #2 is the bigger concern, so we actually have the read-only area mounted as a read-only filesystem, but this is causing its own problems.

share|improve this question
The ftp server must be only vsftpd? – ALex_hha Mar 2 at 21:02

You can use the bind mount option to map/remount an already mounted part of a file system hierarchy to somewhere else. Say you have a samba share with Videos and a second with an Image library and you want to offer those as a read only FTP downloads.

mkdir -p /var/ftp/Videos /var/ftp/Images
mount --bind /share/Videos /var/ftp/Videos
mount --bind /share/Images /var/ftp/Images

Then make those file systems read-only:

mount -o remount,ro /var/ftp/Videos
mount -o remount,ro /var/ftp/Images

The file system permissions remain unaltered, but everything under Videos and Images is now read-only. So it is unlikely that a sub-directory with drwx------ can be accessed by the FTP user, but neither can the FTP user write to in a sub-directory with drwxrwxrwx permissions.

The bind mount doesn't take options so to achieve a read-only mount requires a remount and therefore I think you can't use fstab to make this persistent and need to script this instead.

Next set up the upload directory:

mkdir -p /var/ftp/Upload
chmod 700 /var/ftp/Upload
chown ftp.ftp /var/ftp/Upload 

Then configure vsftpd properly for anonymous downloads and chroot() the anonymous FTP user to /var/ftp. It's been a while since I did that, but roughly and untested:

# /etc/vsftpd/vsftpd.conf
#The following directives prevent local users from logging in and enables anonymous access respectively.
#The following directive enables write access to the ftp server’s filesystem. 
# Sets the root directory for anonymous connections.

Of course there are a lot more relevant options to include.

share|improve this answer
mount -o remount,ro /var/ftp/Images mount: /var/ftp/Images is busy – c4f4t0r Jun 24 '15 at 12:36
Can you check with lsof if any files are opened on that mount point. – HBruijn Jun 24 '15 at 14:13
/share/Videos 153724820 125121348 28603472 82% /var/ftp/Videos /share/Images 153724820 125121348 28603472 82% /var/ftp/Images lsof | grep "/var/ftp" doesn't show nothing – c4f4t0r Jun 24 '15 at 16:04

You can easily get what you want with proftpd

   ServerName "ANONYMOUS"

   Protocols ftp
   Port 21

   DefaultRoot /var/ftp/pub/

   <Anonymous /var/ftp/pub/>
      User ftp
      Group ftp
      UserAlias anonymous ftp

      MaxStoreFileSize 100 Mb user ftp

      <Directory /var/ftp/pub/>
         <Limit RMD MKD XMKD XRMD>
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.