I'm trying to setup a vsftp server with virtual users and as far as I understand those virtual users are just "subaccounts" of user ftp, then those files uploaded by a virtual user would be owned by user ftp.(correct me if I am wrong)

The purpose of those virtual users is just to upload and modify a web page, so should the directory lets say /var/www/html be owned by user ftp and then chroot a virtual user in this directory or does it imply any security risk? Could those virtual users login with rsa keys instead of passwords or is that only possible for ssh and real users?

up vote 4 down vote accepted

The reason you're having trouble with this question is you have not sufficiently thought about your desired intention of what each account is going to facilitate. The question you need to ask yourself is;

  • Do all virtual users in this system have mutual access to all managed objects?

By this I mean, does virtual user A have the same access requirements as virtual user B?

If the answer is yes, you're requirement is to offer unique authentication over multiple accounts yet all users have the same authorization relationship.

If that is the case, what you are doing works.

If the answer is no this means you want to offer unique authentication and unique authorization for said accounts.

In this form, the design is fundamentally flawed, because it is impossible for the system-level authorization to identify one virtual user over another.

  • In the second case that you have said, could unique authorization be granted by chrooting different users in different folders? or is it completely messed up? – Javier Mar 9 '14 at 2:48
  • @Matthew : actually, I think it's specific to VSFTPd (and a few others maybe). Pure-FTPd for instance allows you to specify a lot of user-specific information in the backend, which can lead to deeply user-specific settings (physical UID/GID for each user, chroot, throttling...). Conceptually, it is possible to set a different environment for each virtual user, but it doesn't seem possible on VSFTPd's basic implementations. – John WH Smith Mar 9 '14 at 3:06
  • @john-wh-smith pure chroot does not offer much in terms of security here. I could upload a setuid binary as my system user and execute it in CGI/PHP which will allow me to modify all the files outside of the chroot (as the webserver does not chroot me). – Matthew Ife Mar 9 '14 at 10:34

VSFTP provides a chroot feature. Your virtual user has a document root, and it can be chrooted into it using :

write_enable=YES
chroot_local_user=YES
local_root=/var/www/html/$USER
user_sub_token=$USER

As far as ownership is concerned, just make sure the FTP user can manipulate the files into each home directory. /var/www/html doesn't need to be owned by it (though it needs eXecution permission on it). You can also use the FTP account's group if you want to use another account as owner. Maybe you could do something like www-data:ftp or ftp:www-data (which is the most common I'd say) on /var/www/html's subdirectories ?

rwxr-x--- ftp www-data /var/www/html
rwxr-x--- ftp www-data /var/www/html/myvirtualuser
rwxrwx--- ftp www-data /var/www/html/myvirtualuser/someuploaddirectory

UNIX permissions are quite a strong mechanism. There wont be any security risk as long as you take time to think who needs what.

Edit about RSA keys : RSA keys are used in SSH connections, not FTP ones. When it comes to FTP, passwordless authentication usually means anonymous connection, used on public FTP servers such as ftp.kernel.org. You can setup SSL encryption over your VSFTP connections though : see http://wiki.vpslink.com/Configuring_vsftpd_for_secure_connections_(TLS/SSL/SFTP).

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.