1

I have a VPS using Debian 6.0. Currently, SSH is set to not accept password logins, and only key-based ones.

A person who needs to work on one particular website (a vhost) wishes to use FTP. He doesn't need/want SSH. How can I set up FTP access for him, enabling him to have write permissions for all files in the relevant directory, and only the relevant directory? The directory is /srv/www/domainname.com/public_html

Currently, all directories and files in that directory belong to www-data:www-data and are 644/755.

I've installed vsftpd and have been reading some guides, but they all seem to deal with allowing multiple users to have their own user-named directories which isn't what I'm after. I can't seem to work out how to simply define one FTP user with a password that has access to one directory of my choosing.

This is my first experience of setting up an FTP server.

Thanks.

Edit: have also found this - maybe I should be using ProFTPd, or can vsftpd also do what I want?

5
  • 2
    The world would be a better place if you forced this user to use sftp/scp. With the easy availability of nice GUI scp clients, there's really no reason to do otherwise.
    – EEAA
    Mar 2, 2011 at 23:13
  • What would be an easy way to set SFTP up? This is very much new ground to me. :) Mar 2, 2011 at 23:15
  • Just had an idea sort of based on your comment. Could I set him up with a system user account, set his home directory to that of the website public html and turn on password authentication so that his FTP program can login? This would negate the need for an FTP server as merely having SSH access would allow use of, for example, FileZilla? But how would I limit him to seeing just that directory? Mar 2, 2011 at 23:19
  • I've found another page, and this seems to fit in with your advice. howtoforge.com/chrooted-ssh-sftp-tutorial-debian-lenny Could I follow the section on "Chrooted SSH/SFTP Tutorial" and make the "ChrootDirectory" /srv/www/domainname.com/public_html ? Mar 2, 2011 at 23:28
  • Yes, that tutorial should describe setting up a sftp. It really should be very easy.
    – Zoredache
    Mar 2, 2011 at 23:49

1 Answer 1

2

If you want to go with the SFTP only solution, I have created a blog post recently that describes exactly this including a few of the common errors: http://blog.frands.net/sftp-only-chroot-users-with-openssh-in-debian-166/

If you want to go with the FTP solution, vsftpd is indeed a fine choice. However, when a user uploads a file it will be set with his user and group following the defined umask. You could set the user's primary group to www-data and then create a umask that fits in vsftpd.

This is a quick-howto do what I suggested:

Create the user with the www-data group, no real shell and the correct home dir, set the password afterwards

useradd -d /path/to/his/domain.com -g www-data -s /bin/false theusername
passwd theusername

Make sure that vsftpd accepts his shell. cat /etc/shells and look for /bin/false (it should not be there by default) - if it not there, add it:

echo "/bin/false" >> /etc/shells

Next, edit the vsftpd config file. Touch these parameters: (if they are commented out, remove the #)

Disable anonymous access to the server

anonymous_enable=NO

Allow local users to use FTP

local_enable=YES

Allow file uploads

write_enable=YES

Set the umask, so the files the user uploads are also writable by group (www-data)

local_umask=002

Chroot the user so he cannot move out of his home dir

chroot_local_user=YES

Now, restart vsftpd

/etc/init.d/vsftpd restart

and you should be all set.

BUT!

  • FTP is generally insecure.
  • If SFTP is possible, use it.
  • Having the webserver allowed to write to files is a security flaw, unless the directory is used for uploads or files that the website commonly changes.
2
  • Thanks a lot - the SFTP route seems ideal. However, permission is being denied. When trying using sftp from a client at the command line with the verbose option, I'm getting user@ipaddress's password: debug1: Authentications that can continue: publickey,password Permission denied, please try again. Have doublechecked password. Not getting the bad ownership or modes errors you mention. Mar 3, 2011 at 1:06
  • Figured it out - I needed to allow the user group higher up in the sshd_config file as I had previously been controlling ssh access via AllowGroups. Thanks! Mar 3, 2011 at 1:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .