Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was looking for a somewhat less strenuous way to add users every few days (that wish to be granted ftp access with their own folder) on my site. I had found this guide on the softlayer KB for vsftp (I run on Ubuntu Server)

Create a FTP user group. eg: ftpaccounts
#/usr/sbin/groupadd ftpaccounts

Add a new user to this group, and set the default path of that user to /home/user/.
#/usr/sbin/adduser -g ftpaccounts -d /home/user/ testuser

Set a password for the newley created user.
#passwd testuser

Set ownership of /home/user to the testuser and ftpaccounts.
#chown testuser:ftpaccounts /home/user

Give Read/Write access to testuser and all members in ftpaccounts
#chmod 775 /home/user

Edit /etc/vsftpd/vsftpd.conf file and make sure 'local_enable=YES' is uncommented.

Restart the vsftpd service.
#/etc/init.d/vsftpd restart 

Now only using this guide, such as setting them up with their own chowned /home/ folder, will they only be able to log in/modify /home/user and log in via FTP to user@mysite.com, or is this a security risk?

Virtual users seened a little hard for me, so I am looking at this.

share|improve this question
    
Virtual users does seem like the solution though, try having a search around for some beginners guides. – Sirex Jan 19 '11 at 11:39

consider using only sftp for your users. ftp transfers passwords and content unencrypted, nice little attack vector for 'evildoers' :)

share|improve this answer
    
Ah, I was wondering why I was choosing FTP over SFTP, forgot about that. You should had posted this as a comment rather than an answer. – Don Njero. Jan 19 '11 at 12:33
    
@Don Njero: why? does prepending the obvious 'No.' add value to my answer? – akira Jan 19 '11 at 13:19

As with akira's suggestion and a bit of googling, I had found a simple way to make an SFTP-only account. This would require this entry in /etc/passwd:

(assuming the path is my sftp server)

sftponly:x:9042:8080:sftp-only:/home/sftponly:/usr/local/libexec/sftp-server

After passwd'ing it, I add this to /etc/shells

echo "/usr/local/libexec/sftp-server" >> /etc/shells

And it should be tied to /home/sftponly. I have yet to try this, so if someone stumbles upon this and sees something downright wrong, feel free to point it out. I will test what I can.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .