I'm running Ubuntu 10.04 i386. I use Cyberduck (FTP GUI client) to connect to my server mysub.domainname.com (changed here).

This is what I want to be able to do:

1) Change apache2 root from /var/www to /home/myuser/webroot to serve files like index.html

2) Allow FTP to write in /home/myuser/webroot

3) Allow myuser to login with his user/pass combo with FTP and read/write anywhere within myuser folder

Apache2 root folder works fine. Going to myserver.com/index.html works. But I can't get FTP to write, even though I changed these lines in etc/vsftpd.conf:

#ftpd_banner=Welcome to blah FTP service.
# chroot_list_enable below.

The problem

Whenever I try to create a folder in /home/myuser or /home/myuser/webroot I get error Create directory operation failed. in my FTP program, Cyberduck.

Maybe helpful info:

drwxrwsr-x 2 myuser www-data 4096 2011-04-18 03:04 webroot

and I changed the permissions here too:

-rw-rwSr-- 1 myuser root 69 2011-04-18 02:14 index.html

...BUT no luck. I still can't upload or write using FTP. Any suggestions or pointers would be great, I'm pretty squarely lost on this one.


I tried enabling anonymous logins for FTP, and I could not even get that to work...I think the only solution is to completely purge system of vsftpd and apache2 and just start over

  • Good question. All the walkthroughs I find online are for virtual users rather than normal local users, so it seems that what you have should work. What happens if you try uploading to a world-writable directory like /tmp ? If it works, who owns the file?
    – DerfK
    Apr 18, 2011 at 22:38
  • When I upload a file to /tmp, say "something.js" using Cyberduck logged in as myuser, it does work. The file is owned by myuser. Apr 18, 2011 at 22:45
  • @lollercoaster might be SELinux. What does ls -ldZ /home/myuser/webroot/ say, and do you have any relevant messages in /var/log/audit.log?
    – DerfK
    Apr 18, 2011 at 23:25
  • root@myserver:/# ls -ldZ /home/myuser/webroot ls: cannot access /home/myuser/webroot: No such file or directory Apr 18, 2011 at 23:32
  • and no messages in /var/log/audit.log in fact there is no such file on my machine Apr 18, 2011 at 23:34

1 Answer 1


For permissions, you need to have the folder and files in it owned by myuser so that they can be accessed from the myuser account.

If apache (or your scripts) needs to write to the folder, then the best thing to do is use chgrp to assign the specific locations that should be written to to the www-data group, then chmod g+w that location or file. If you are giving write access to a folder, chmod g+sw will give write access to the folder and ensure that files created there will also belong to the www-data group.

The files and directories in this case would look something like:

drwxrwxr-x 2 myuser   www-data    4096 2011-04-18 03:04 webroot
-rw-rw-r-- 1 myuser   www-data    1000 2011-04-18 03:04 index.html
drwxrwsr-x 2 myuser   www-data    4096 2011-04-18 03:04 folderwithg+ws

You would want to be very careful giving write access to files and folders to apache though, otherwise an attacker might figure out a way to make your scripts overwrite themselves or replace index.html, or whatever.

Otherwise, if apache does not need to write to your document directory, the permissions should be fine as it is long as all of the subdirectories and files are world readable (and directories are world accessible).

For SSL/TLS, you're missing


You can force users to use encryption:


And there is a ssl_ciphers= option as well, if you want to limit it to HIGH or a specific list of ciphers. If you want "implicit SSL" (instead of AUTH SSL or AUTH TLS commands to start encryption, the encryption is negotiated at the beginning of the connection) then that is implicit_ssl=YES

  • OK, cool. So given that the webroot folder is owned by root and www-data as seen here: root@myserver:/home/myuser# ls -l returns drwxr-xr-x 2 www-data root 4096 2011-04-18 03:04 webroot - then I should change ownership using chown myuser webroot. but that is still confusing, can I have both www-data and myuser still have ownership? I want to have the myuser folder and all of its subdirectories read/write capable for BOTH Apache and FTP. Is that possible? Apr 18, 2011 at 23:52
  • @loller www-data is the owner, root is the group. Standard Unix permissions are based on owner, group, then everyoneelse. If the folder is owned by "myuser" and the first set of "rwx" is enabled, then myuser has read write and access/execute permissions. If you change the group to www-data (ubuntu's default apache group) then use the chmod command I gave to enable group write access (second set of "rwx" is enabled (x will be "s" if you used g+sw)) then apache, being a member of www-data group, will be able to write to it.
    – DerfK
    Apr 19, 2011 at 0:13
  • not working. I'll update my original post to be clearer. I'm really not sure what the problem is - I still can't upload with FTP or create files Apr 19, 2011 at 2:47
  • I wonder if it thinks you're using virtual users? I can't really find a guide that explains what makes virtual users with PAM different from local users with PAM... try virtual_use_local_privs=YES
    – DerfK
    Apr 19, 2011 at 4:03
  • hmmmm. good thought, but it didn't seem to work either. Apr 19, 2011 at 5:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .