/var/www/html owned by ftp user?

Question

I'm trying to setup a vsftp server with virtual users and as far as I understand those virtual users are just "subaccounts" of user ftp, then those files uploaded by a virtual user would be owned by user ftp.(correct me if I am wrong)

The purpose of those virtual users is just to upload and modify a web page, so should the directory lets say /var/www/html be owned by user ftp and then chroot a virtual user in this directory or does it imply any security risk? Could those virtual users login with rsa keys instead of passwords or is that only possible for ssh and real users?

Answer 1

The reason you're having trouble with this question is you have not sufficiently thought about your desired intention of what each account is going to facilitate. The question you need to ask yourself is;

• Do all virtual users in this system have mutual access to all managed objects?

By this I mean, does virtual user A have the same access requirements as virtual user B?

If the answer is yes, you're requirement is to offer unique authentication over multiple accounts yet all users have the same authorization relationship.

If that is the case, what you are doing works.

If the answer is no this means you want to offer unique authentication and unique authorization for said accounts.

In this form, the design is fundamentally flawed, because it is impossible for the system-level authorization to identify one virtual user over another.

Answer 2

VSFTP provides a chroot feature. Your virtual user has a document root, and it can be chrooted into it using :

write_enable=YES
chroot_local_user=YES
local_root=/var/www/html/$USER
user_sub_token=$USER

As far as ownership is concerned, just make sure the FTP user can manipulate the files into each home directory. /var/www/html doesn't need to be owned by it (though it needs eXecution permission on it). You can also use the FTP account's group if you want to use another account as owner. Maybe you could do something like www-data:ftp or ftp:www-data (which is the most common I'd say) on /var/www/html's subdirectories ?

rwxr-x--- ftp www-data /var/www/html
rwxr-x--- ftp www-data /var/www/html/myvirtualuser
rwxrwx--- ftp www-data /var/www/html/myvirtualuser/someuploaddirectory

UNIX permissions are quite a strong mechanism. There wont be any security risk as long as you take time to think who needs what.

Edit about RSA keys : RSA keys are used in SSH connections, not FTP ones. When it comes to FTP, passwordless authentication usually means anonymous connection, used on public FTP servers such as ftp.kernel.org. You can setup SSL encryption over your VSFTP connections though : see http://wiki.vpslink.com/Configuring_vsftpd_for_secure_connections_(TLS/SSL/SFTP).