Is it possible to configure vsftpd to CWD a chrooted user to a subdirectory upon login?

Question

We have a system that logs into an FTP server (vsftpd on Linux), uploads a file to the default directory it lands in (it doesn't CWD) and then exits. For reasons beyond the scope of this question, it would be a pain to modify the FTP client application to have it change directories.

The user account that performs the upload is not currently chrooted, but I would like to chroot the account to improve security. However, the top-level chroot directory can't be writable according to vsftpd. Dropping the file in a subdirectory would be fine, but the client application doesn't have an option to change directories after login.

Considering this, is it possible to have the account's initial directory set to something other than / if it is chrooted?

I have tried using the local_root option in vsftpd.conf, but that just chroots the user to the given directory, still starting them in / versus a subdirectory like /putfileshere/.

Only the one account will ever need to log into this FTP server if that helps.

Answer 1

My solution was to set allow_writeable_chroot=YES in vsftpd.conf

Answer 2

I have the exact same issue with local_root= in the vsftpd.conf. Most ftp's assume that local_root = $home_folder , but this is not always the case. A chroot's objective should be to not permit anyone to go one folder back from the jailed directory, that's all. It's the root folder in the tree but not the landing directory! There should be the option to specify a $home_folder within the jailed tree. Consider this matching block for sftpd in sshd_config:

     Match Group mtlsftpprd001_edi-ftp
                ChrootDirectory /folder/cifs
                X11Forwarding no
                AllowTcpForwarding no
                ForceCommand internal-sftp -l INFO -d %u
                KerberosAuthentication yes

Every sftpd login that matches that AD group will now land in /folder/cifs/$USER and will be permitted to cd only one folder back. In filezilla the path will be /$USER instead of / . The vsftpd.conf could implement similar with :

user_sub_token=$USER
local_root=/folder/cifs
home_folder=/folder/cifs/$USER

At the moment I can't do this so I'm looking for ways to auto run "CWD /folder/cifs/$USER" upon login.