45

I need to periodically give temporary and limited access to various directories on a CentOS linux server that has vsftp installed.

I've created a user using useradd [user_name] and given them a password using passwd [password].

I've created a directory in /var/ftp and then I bind this to the directory that I wish to limit access to.

What else do I need to specifically do to ensure that when this user logs into FTP, they only have access to this directory please?

Improve this question
6
  • Sorry but have you ever considered to check vsftpd.conf?
    – jirib
    Oct 9, 2013 at 12:21
  • Yes. I have. It doesn't tell me how to instruct a specific user to log in to a specific directory...?
    – zigojacko
    Oct 9, 2013 at 12:30
  • 1
    Sure? chroot_list_enable option... Or you mean to override directory different than $HOME?
    – jirib
    Oct 9, 2013 at 12:34
  • 1
    I want to know how to declare a specific home directory for a specific user. I've enabled chroot_list_enable and created /etc/vsftpd/chroot_list. I just didn't know what to do next.
    – zigojacko
    Oct 9, 2013 at 13:09
  • Then usermod to change user's homedir.
    – jirib
    Oct 9, 2013 at 13:11

4 Answers 4

Reset to default
62

Complete answer that solved my question for any others that are after a step by step walkthrough...

Install vsftpd using this as a guide.

  • Create user with useradd [user_name].
  • Create user's password with passwd [user_name]. (You'll be prompted to specify the password).
  • Create FTP directory in /var/ftp and then bind to the 'home' directory you wish to specify for this user with mount --bind /var/www/vhosts/domain.com/ /var/ftp/custom_name/.

  • Change user's home directory with usermod -d /var/ftp/custom_name/ user_name

    In /etc/vsftpd/vsftpd.conf, ensure all all of the following are set:-

    • chroot_local_user=YES
    • chroot_list_enable=YES
    • chroot_list_file=/etc/vsftpd.chroot_list

Only list users in the vsftpd.chroot_list file if you want them to have full access to anywhere on the server. By not listing them in this file, you're saying restrict all vsftpd users to their specified home directory.

In other words (for reference):-

  1. means that by default, ALL users get chrooted except users in the file...
    • chroot_local_user=YES
    • chroot_list_enable=YES
  2. means that by default, ONLY users in the file get chrooted...
    • chroot_local_user=NO
    • chroot_list_enable=YES
Improve this answer
5
  • Why not setting the home directory of that user directly to /var/www/vhosts/domain.com/? Is there some problem with that (like any potential risks)?
    – leemes
    Aug 7, 2014 at 19:12
  • 2
    I just found out that vsftp seems to forbid to grant an ftp user write permissions on the chroot top level for security reasons (but I'm not 100% sure). So that might be a reason to have this "indirection" in order to grant the ftp user write access to a specific folder while not allowing to view any sibling folder (which would be the case if you simply set his home one level up, which avoids the mentioned issue). (see ubuntuforums.org/…)
    – leemes
    Aug 7, 2014 at 21:21
  • 2
    @zigojacko does your user only see their assigned home dir? For me, this defaults the user to the assigned directory, but, they still can see other folders and can snoop around all the way up to root, though with only read access.
    – GraehamF
    Feb 20, 2018 at 15:26
  • 1
    This answer, in combination with unix.stackexchange.com/questions/208960/… was the full answer for me. I ended up creating a user in a group and limited the group access to the desired directory.
    – GraehamF
    Feb 20, 2018 at 15:52
  • 1
    If you use "mount" you do it only once if I'm correct? An entry in /etc/fstab would be better I think?
    – Martin Eckleben
    Feb 19, 2020 at 8:58
14

For me it didn't work even after the above. There was a local_root already set to a directory, and whatever I do, user's directory hasn't jailed. Finally it is worked after only changed

chroot_local_user=YES

And following procedure

  1. vi /etc/vsftpd.conf
  2. Add the line 'user_config_dir=/etc/vsftpd_user_conf' (no quotes)
  3. mkdir /etc/vsftpd_user_conf;
  4. cd /etc/vsftpd_user_conf
  5. vi user_name;
  6. Enter the line 'local_root=/srv/ftp/user_name'

Just my two cents if anyone else had same issue.

Improve this answer
7
  • I followed this procedure to change the root directory of vsftpd, including the additional steps by gnaanaa. Unfortunately, it doesn't work yet. Filezilla reports 530 Login incorrect. The user and password are according to the procedure above (user_name). I created a test user ftp2, and set its password. The Filezilla normal logon uses that username and password. I also set the root directory read only, and created a lower level directory with write permissions according to this post I'm using Ubuntu 16.04 if that makes any difference.
    – tim11g
    Jun 14, 2016 at 14:35
  • I'm using Ubuntu 16.04 if that makes any difference, @gnaanaa. Also I thought it was odd that there was no ftp directory in /var. So I had to create /var/ftp, and then /var/ftp/user_name. code<br/> Response: 220 (vsFTPd 3.0.3)<br/> Command: USER ftp2<br/> Response: 331 Please specify the password.<br/> Command: PASS *****<br/> Response: 530 Login incorrect.<br/> Error: Critical error: Could not connect to server <br/> code
    – tim11g
    Jun 14, 2016 at 14:42
  • Firstly, look why you couldn't login to the server. You can debug the issue with jailing only after success login. Cheers.
    – gnaanaa
    Jun 15, 2016 at 23:01
  • Does vsftp use a different user/password compared to the accounts on the machine? I discovered that smb passwords had to be set separately with smbpasswd -a. Does vsftpd work the same way?
    – tim11g
    Jun 16, 2016 at 12:08
  • No, it is the system user account. check this answer : askubuntu.com/questions/413677/vsftpd-530-login-incorrect
    – gnaanaa
    Jun 16, 2016 at 22:23
0

what if you want everyone to have chroot but a different landing folder within that chroot?

local_root=/folder
home_folder=$local_root/$USER

Is this not reasonable ?

Improve this answer
-1

The chrooting mentioned in previous answers didn't work on my ubuntu 18.04 server. I finally got it working using this reference: https://passingcuriosity.com/2014/openssh-restrict-to-sftp-chroot/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .