0

I'm running ProFTP on Centos 7. I have successfully installed the server and created a user that can login to the server. The problem is that the user always gets access to the root directory of the server instead of being chrooted into their home directory. Additionally, the root user can login as well, even though I turned it off in the options file.

Excerpt from /etc/passwd:

ftpadmin:x:1003:1005::/opt/qnap/:/bin/false

/etc/shells:

/bin/sh
/bin/false
/bin/bash
/usr/bin/sh
/usr/bin/bash

Excerpt from /etc/proftpd.conf:

# Cause every FTP user except adm to be chrooted into their home directory
DefaultRoot                     ~ adm
RootLogin                       off

# Use pam to authenticate (default) and be authoritative
AuthPAMConfig                   proftpd
AuthOrder                       mod_auth_pam.c* mod_auth_unix.c

Can anyone tell me what's going on?

1

According to my reading of http://www.proftpd.org/docs/directives/linked/config_ref_DefaultRoot.html your syntax is wrong, and, I suspect only chrooting members of the Adm group. I would try changing the line to read

  DefaultRoot ~

To Chroot everyone to their home directories (because it's clean, easy and an admin should not be using FTP imho).

Alternatively, I wonder if

 DefaultRoot ~ users,!adm

Would Chroot everyone except members of the adm group.

  • Thanks for your answer, but that had no effect. DefaultRoot ~still defaults everyone to /. – Fang Jan 11 at 19:23
  • Did you restart the service after making the changes? – davidgo Jan 11 at 19:27
  • I did restart the server (to no effect). But your answer is correct in that the syntax of DefaultRoot was definitely wrong. – Fang Jan 11 at 19:35
0

Some more testing revealed this to be a client issue.

I was under the impression that DefaultRoot would force any FTP client to use that directory - this seems to not be the case.

FileZilla seems to honor the DefaultRoot option just fine, whereas FTP Client Pro (IOS) seems to entirely ignore it.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.