0

Using Centos7 and vsftpd I would like to chroot the user "testftp" to his home folder /home/testftp.
The client uses WinSCP on Windows.
The user testftp can reach the server and connects initially to his home folder.
However the user is still able to browse higher levels.

passwd:

testftp:x:1001:1001::/home/testftp/:/bin/bash

vsftpd.conf:

chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list

Home Folder testftp:
This has been modified with chmod 500 because of this line in the vsftpd.conf
(Warning! chroot'ing can be very dangerous. If using chroot, make sure that the user does not have write access to the top level directory within the chroot)

dr-x------. 3 testftp testftp 73 Dec 5 10:44 testftp

Inside the Home Folder is another folder called ftp:

drwx------. 2 > testftp testftp 44 Dec 5 10:52 ftp

2
  • Check the logs on the server. Dec 4 '18 at 16:00
  • Sat Dec 8 18:23:26 2018 [pid 7965] [ftptest] FTP response: Client "::ffff:192.168.0.254", "331 Please specify the password." Sat Dec 8 18:23:26 2018 [pid 7965] [ftptest] FTP command: Client "::ffff:192.168.0.254", "PASS <password>" Sat Dec 8 18:23:26 2018 [pid 7964] [ftptest] OK LOGIN: Client "::ffff:192.168.0.254" The authentication is OK but WinSCP still returns "Oops chroot" Dec 8 '18 at 17:25
0

Try this...
vim into /etc/vsftp.conf and add -> allow_writeable_chroot=YES
restart server -> service vsftpd restart
-or-
exit vim and run this command -> chmod a-w /home/testftp
restart server -> service vsftpd restart

1
  • Thanks for your response but adding the line and restarting the service does not make the user jailed to his home folder. Dec 5 '18 at 10:17
0

Found the answer myself.

Make another folder inside the home folder:

mkdir /home/ftptest/ftp

change the vsftpd.conf file with the following:

chroot_local_user=NO
chroot_list_enable=YES
user_sub_token=$USER
local_root=/home/$USER/ftp (this is the folder we just created)

This setup makes sure that no users are chrooted except the ones inside the chroot_list
If you want everyone to be chrooted except the ones in the chroot_list, change chroot_local_user=YES.

This way every user has access to the FTP service (chrooted or not). If you want specific users to not be able to access the FTP service, or the other way around, all users except a few, use userlist in vsftpd.conf.

Source

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.