Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using Ubuntu 13.10 with vsftpd, and trying to limit a FTP user to their respective directory.

For this, I am using the following

My vsftpd.conf :

local_enable=YES
write_enable=YES
local_umask=022
secure_chroot_dir=/var/run/vsftpd/empty
nopriv_user=vsftpd
virtual_use_local_privs=YES
user_sub_token=$USER
local_root=/var/www/sites/$USER
chroot_local_user=YES
hide_ids=YES
seccomp_sandbox=NO
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
require_ssl_reuse=NO
ssl_ciphers=HIGH

I configured pam.d/vsftpdcreate virtual users for FTP as follows :

htpasswd -cd /etc/vsftpd/ftpd.passwd USERNAME
useradd --home /home/vsftpd --gid nogroup -m --shell /bin/false vsftpd

mkdir /var/www/sites/USERNAME
chmod -w /var/www/sites/USERNAME
mkdir /var/www/sites/USERNAME/www
chmod -R 755 /var/www/sites/USERNAME/www
chown -R vsftpd:nogroup /var/www/sites/USERNAME

The setup if for running simple PHP websites, and the above setup works fine, and when connected I can view only the my directory.

The problem is when I have a file like :

<?php
exec('cat /var/www/SOME_OTHER_USER_FILE', $output);
print_r($output);

It prints the contents of files, which are outside of the user's directory. How can I avoid this?

Note : The permissions of the dir are as follows :

drwxr-xr-x 2 vsftpd nogroup 4096 Apr  5 04:55 .
dr-xr-xr-x 3 root   root    4096 Mar 23 10:00 ..
-rw-r--r-- 1 vsftpd nogroup  113 Apr  5 04:44 index.php

How can I avoid a user navigating outside of the assigned directory? I've tried searching for it, but cannot seem to find any solution.

share|improve this question

1 Answer 1

this isn't a ftp problem, but a php problem, try to use in your virtualhost

php_value open_basedir "/dir_of_your_virtualhost

in this you php can only work in that directory

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.