5

I've read documentation for various ftp daemons and various long threads about the security implications of using a chroot environment for an ftp server when giving users write access. If you read the vsftpd documentation, in particular, it implies that using chroot_local_user is a security hazard, while not using it is not. There seems to be no coverage of the implications of allowing the user access to the entire filesystem (as permitted by their user and group membership), nor to the confusion this can create.

So, I'd like to understand what is the correct method to use in practice. Should an ftp server with authenticated write-access users provide a non-chroot environment, a chroot environment, or some other option? Given that Windows ftp daemons don't have the option to use chroot, they need to implement isolation otherwise. Do any unix ftp daemons do something similar?

Improve this question
3
  • 2
    You may want to read this - kerneltrap.org/Linux/Abusing_chroot chroot was never designed as a security device and there are known and documented ways to escape it.
    – MDMarra
    Apr 26, 2010 at 23:51
  • Yes, I've skimmed this document, but all it seems to do is tell me what NOT to do, rather than what to do.
    – djs
    Apr 27, 2010 at 1:14
  • 1
    it wasn't an answer to your question, just a reference about chroot being relied on for security as dangerous. That's why I left it as a comment and not an answer.
    – MDMarra
    Apr 27, 2010 at 6:20

2 Answers 2

Reset to default
1

The correct practice you will use depends on the software you use.

If you know all your users, then I'd say using chroot is not a big deal. If you are giving accounts to people you don't if you can trust, then you may not want to.

You may want to also take a look at pureftpd and it's "chroot" options:

Apart from the "-a" flag, Pure-FTPd has another way to fine-tune chroot() rules. Let's take an /etc/passwd entry:

mimi:x:501:100:Mimi:/home/mimi:/bin/zsh

Without any special rule, mimi will be able to log in and to retrieve any public-readable file in the filesystem. Now, let's change a bit of its home directory:

mimi:x:501:100:Mimi:/home/mimi/./:/bin/zsh

So what? Mimi's home directory is still the same and common applications shouldn't notice any difference. But Pure-FTPd understands "chroot() until /./". So when mimi next carries out a FTP log in, only the /home/mimi directory will be reachable, not the whole filesystem. If you don't like the "-a" and its trusted gid thing, this is a good way to only chroot() some users.

http://download.pureftpd.org/pub/pure-ftpd/doc/README

Of course please do your research concerning security issues. Don't take anyones word for it.

You don't need to use chroot to achieve isolation. That just makes it look nice for the user and the ignorant will think there are no other files on the server. You could also use file permissions to keep users from snooping around. You could also run your ftp daemon in a VM and reduce the risk further.

Improve this answer
2
  • If I trust the users, what is point to using chroot then? If I don't trust the users, and they are unfamiliar, why would I want to confuse them with a root directory that shows lots of stuff unrelated to their home directory?
    – djs
    Apr 27, 2010 at 1:44
  • Yes, exactly. Why would you want to do that? Do you know about the security issues related to chroot in an FTP server? If you are concerned about that, then you are obviously being very careful. If you are being that careful, then my comment applies. However, more importantly, you'd like to find a safe way to chroot. Correct? I'll edit my reply to include what I was refering to from pureftp. Hope that helps.
    – d-_-b
    Apr 28, 2010 at 0:43
-1

Use vsftpd, "Probably the most secure and fastest FTP server for UNIX-like systems." Yada Yada Yada, (which I got straight from their website, which I also believe to be true.) I thing vsftpd is by default the most secure unix ftp server....it's written by a vulnerability researcher.

http://vsftpd.beasts.org/ It's designed to use chroot per the basic config.

What do all these ftp sites have in common?

  1. ftp.redhat.com
  2. ftp.suse.com
  3. ftp.debian.org
  4. ftp.openbsd.org
  5. ftp.freebsd.org
  6. ftp.gnu.org
  7. ftp.gnome.org
  8. ftp.kde.org
  9. ftp.kernel.org
Improve this answer
3
  • 1
    Did you read the question?
    – djs
    Apr 27, 2010 at 20:47
  • 1
    What do they have in common? They're all public DOWNLOAD servers.
    – John Gardeniers
    Apr 28, 2010 at 4:01
  • my point was they all use vsftpd.
    – Luke
    Apr 30, 2010 at 1:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .