-1

I just installed Pure-FTPd (pure-ftpd-1.0.30-1.el6.x86_64) on my CentOS 6.5 server.

I'm using "virtual users", so the FTP users are disconnected from the system accounts.

Nevertheless, the pure-ftpd daemon itself is running as root, and all the uploaded files are root-owned.

On the manual I read that all the clients are chrooted to their home dir, but I'm a bit uneasy with the uploaded file being uploaded+owned by root. Should I change the pure-ftpd users or am I worrying for nothing?

A few clarifications:

1) I'm trying to do an assessment on the security of this configuration: if I find out that this default is safe, I'm more than happy to keep it as it is and don't mess with it

2) Buffer overflows are one of the aspect I worry about

Improve this question

2 Answers 2

Reset to default
0

You're worrying for nothing, there's no possible way (that I'm aware of) to execute code inside an FTP chrooted shell (unless you have remote access to the system, i.e. SSH).

Improve this answer
1
  • If process is running as root is possible to "evade" the chroot
    – elbarna
    Sep 7, 2015 at 23:43
0

A quick review of the docs alludes to the ability to run "100% non-root" if you're feeling nervous why not look into that?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .