Arch Linux

pivotraze

Member

From: Missoula, MT

Registered: 2011-08-21

Posts: 113

LAMP + FTP problem, specifically FTP

Okay, so I'm setting up a home server for me and some friends.

I set up FTP and only want my friends to have access to their specific directory. How can I accomplish this?

Example (Usernames removed): I have the following directories:
/srv/ftp/user1
/srv/ftp/user2
/srv/ftp/user3

Each user can access, upload, and remove files from one anothers folders. Why?

Here is my /etc/vsftpd.conf file:

anonymous_enable=NO
local_enable=YES
write_enable=YES
anon_upload_enable=NO
anon_mkdir_write_enable=NO
anon_other_write_enable=NO
chroot_local_user=YES
guest_enable=YES
guest_username=virtual
listen=YES
listen_port=21
virtual_use_local_privs=YES
pam_service_name=ftp

When I add the following two lines:

local_root=/srv/ftp/$USER
user_sub_token=$USER

I can not get into the FTP at all with any username.

If I add the following line instead:

user_config_dir=/etc/vsftpd/vusers

This should happen:

I have a seperate folder (/vsftpd) that has the following structure:
vsftpd_login.db
vusers
--user1
--user2
--user3

and each user file has the following in it:

write_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
anon_upload_enable=YES
local_root=/srv/ftp/(USERNAMEISHERE)
chroot_local_user=YES
dirlist_enable=YES
download_enable=YES
guest_username=virtual

But it doesn't, same problem as if I'm using this code:

local_root=/srv/ftp/$USER
user_sub_token=$USER

What's going on here?

---

NetGUI

n-a-g-r-o-m

Member

From: Joensuu, Finland

Registered: 2008-12-02

Posts: 7

Re: LAMP + FTP problem, specifically FTP

Unless you chroot the users to each have a own little playground, they are allowed to read, write and execute the files on the system based on their user rights.

Most likely why they can see all each others is that their "personal" folders belongs for same group (likely users or ftp) and those folders have read, write and execution permissions for the group (allowing anyone belonging to those groups to do what ever they want).

So you can either do chrooting https://wiki.archlinux.org/index.php/Ve … hroot_jail or you can go and remove the permissions from the group to access those folders

$ chmod -R go-wrx <path/to/the/users/folder>

here "chmod" changes the permisions, "-R" does it for all sub-folders and files in the selected folder, "g" defines group, "o" defines others (even those who are not in same group), "-wrx" removes Write, Read and eXecution rights

pivotraze

Member

From: Missoula, MT

Registered: 2011-08-21

Posts: 113

Re: LAMP + FTP problem, specifically FTP

How would that work though? They are virtual users, and all use the user "virtual" to access their documents in the following folders. The user "virtual" needs access to all those folders haha. Sorry if I'm just blatantly misunderstanding

---

NetGUI

n-a-g-r-o-m

Member

From: Joensuu, Finland

Registered: 2008-12-02

Posts: 7

Re: LAMP + FTP problem, specifically FTP

True! When you are using a virtual users, file system permissions will not help you much. So the only choice is to chroot everybody based on the virtual username, which is exactly what you try to do there with the local_root.

So I took some time to actually test what is the problem and build ftp with exact same setup and this is what I ran into.

$ ftp localhost
ftp: connect to address ::1: Connection refused
ftp: Trying 127.0.0.1 ...
Connected to localhost.localdomain.
220 (vsFTPd 2.3.5)
Name (localhost.localdomain:n-a-g-r-o-m): user
331 Please specify the password.
Password:
500 OOPS: vsftpd: refusing to run with writable root inside chroot()
ftp: Login failed.

They actually tell what is causing that in the troubleshooting section (in the very end) of https://wiki.archlinux.org/index.php/Ve … FTP_Daemon, so I gave it a try and after doing

  chmod a-w /srv/ftp/user/

I can actually login to the ftp now.

I have to say that it's not really nice to disallow users to write to their own root, but maybe you can hide this inconvenience by creating folder "personal" where they can write and "public" where you will just put something to make it look like it's by design OR you can try the vsftpd-ext.

I hope this helps even a bit.