vsftpd permissions for virtual users with Apache SUexec compatibility

Question

I run a linux server with Apache + SUexec where all virtualhosts htdocs folder are owed by specific users :

# ls /www/sites
drwxr-xr-x  4 vhost-sitea.com   vhost-sitea.com   4096 Oct 13 16:45 www.sitea.com/
drwxr-xr-x  3 vhost-siteb.com   vhost-siteb.com   4096 May 14 20:09 www.siteb.com/
drwxr-xr-x  5 vhost-sitec.com   vhost-citec.com   4096 Nov 22  2013 www.sitec.com
drwxr-xr-x  3 vhost-sited.com   vhost-sited.com   4096 Oct 25  2014 www.sited.com/

I want the owners of these websites to be able to connect through VSFTPD and manage their own folders. For that, each virtual user is named "user_a", "user_b"( ... ) based on its website.

My VSFTPD configuration, based on Chroot and Virtual users, is the following:

# cat /etc/vsftpd.conf
listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
nopriv_user=vsftpd
virtual_use_local_privs=YES
guest_enable=YES
user_sub_token=$USER
local_root=/home/vsftpd/users/$USER  # Overridden by user_config_dir below
chroot_local_user=YES
guest_username=vsftpd
user_config_dir=/etc/vsftpd/vsftpd_user_conf

and the user configuration file is (example with "user_a" for website "www.sitea.com") :

# cat /etc/vsftpd/vsftpd_user_conf/user_a
local_root=/www/sites/www.sitea.com
write_enable=YES

Now my issue is, when this user tries to upload a file, VSFTPD uses the "vsftpd" unix user, which fails because the www.sitea.com folder and subfolders are owned by specific "vhost-sitea.com" user (as per SUexec configuration).

You have to understand that under SUexec, Apache "www-data" user is not used at all regarding www virtual folder rights so I cannot simply use it in "guest_username" directive.

Is there a way to specify a VSFTP daemon user for each virtual user that logs in, so that the VSFTPd daemon will write files under "vhost-sitea.com" user, when the virtual "user_a" user is connected with VSftp ?

Thank you for your help, Ken.

Answer 1

For the records, answering to myself : using bindfs and forcing file owner seems to be an interesting workaround, as I got the following :

# bindfs -u vsftpd /www/sites/www.sitea.com/ /home/vsftpd/users/user_a/mnt-www.sitea.com/

Here are the perms on the directory to mount :

# ll /www/sites/www.sitea.com/
total 20
drwxr-xr-x  5 vhost-sitea.com   vhost-sitea.com 4096 Nov 10 20:42 ./
drwxr-xr-x 23 root              root        4096 Nov  8 20:37 ../
drwx------  2 vhost-sitea.com   vhost-sitea.com 4096 Nov  8 20:43 .cache/
drwxr-xr-x  5 vhost-sitea.com   vhost-sitea.com 4096 Nov 10 20:52 html/
drwxr-xr-x  2 vhost-sitea.com   vhost-sitea.com 4096 Nov 10 20:42 packages/

Now let's see the perms on the mounted point :

# ll /home/vsftpd/users/user_a/mnt-www.sitea.com/
total 20
drwxr-xr-x 5 vsftpd vhost-sitea.com 4096 Nov 10 20:42 ./
dr-xr-xr-x 3 root   root        4096 Nov 10 22:12 ../
drwx------ 2 vsftpd vhost-sitea.com 4096 Nov  8 20:43 .cache/
drwxr-xr-x 5 vsftpd vhost-sitea.com 4096 Nov 10 20:52 html/
drwxr-xr-x 2 vsftpd vhost-sitea.com 4096 Nov 10 20:42 packages/

However it could be interesting if anyone of you has a much better solution - let's say a less "Quick and Dirty" one :)

++

Answer 2

You have to set up the vsftpd virtual user system connecting each virtual user to a different system user, so guest_username have to be different for each virtual user, instead of unique.

You have to define guest_username in each virtual user's configuration file, not in the main config file. Besides its value has to be the system user that you use in your suEXEC configuration, for that particular virtual host.

In example, for the virtual user virtual_user connected with the system user local_user, that has an Apache virtual host in /www/sites/local_user, /etc/vsftpd.conf will be:

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
nopriv_user=vsftpd
virtual_use_local_privs=YES
guest_enable=YES
user_sub_token=$USER
local_root=/www/sites/$USER
chroot_local_user=YES
user_config_dir=/etc/vsftpd/vsftpd_user_conf

/etc/vsftpd/vsftpd_user_conf/virtual_user will contain just one line:

guest_username=local_user

To simplify the configuration I have named the folder that contain the Apache virtual host with the local_user. This way you can set up local_root just once in /etc/vsftpd.conf and remove it from each virtual user configuration file.