0

I am trying to setup my vsftpd server to give users access to certain parts of the homepage. Specifically they have access to one directory in the "user" subdomain.

I give you examples with 2 users. shark5060 = admin, havi = user

the whole /var/www/ directory is owned by www-data:www-ftp (including all files and subdirs)

$:/var/www/shark5060.net/.sub-user# ls -al
total 88
drwxrwxr-x 16 www-data www-ftp 4096 Aug  1 23:16 .
drwxrwxr-x 16 www-data www-ftp 4096 Aug 28 02:28 ..
drwxrwxr-x  6 www-data www-ftp 4096 Aug  1 23:08 havi

the ftp users have www-ftp as their main group

$:/home/shark5060# id shark5060
uid=1000(shark5060) gid=1002(www-ftp) groups=1002(www-ftp),27(sudo),1000(shark5060)
$:/home/shark5060# id havi
uid=1004(havi) gid=1002(www-ftp) groups=1002(www-ftp),1005(havi)

here is the configuration of my vsftpd server (only relevant parts)

$:/etc# vi vsftpd.conf
anonymous_enable=NO
local_enable=YES

#keep users in their home dir
chroot_local_user=YES

#except those in this list
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list

#only let those users login
userlist_enable=YES
userlist_file=/etc/vsftpd.user_list
userlist_deny=NO

#config for each user
user_config_dir=/etc/vsftpd_user_conf

#SSL
rsa_cert_file=/etc/ssl/certs/shark5060.net.cer
rsa_private_key_file=/etc/ssl/private/shark5060.net.key
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH

vafptd.user_list contains all users and the admin

$:/etc# vi vsftpd.user_list
shark5060
havi

vsftpd.chroot_list only contains the admin, because he should have access to everything

root@v22019027804982723:/etc# vi vsftpd.chroot_list
shark5060

the vsfptd_user_config dir contains only user files, which all have the setup for the dir they can access.

$:/etc# cd vsftpd_user_conf/
$:/etc/vsftpd_user_conf# ls -al
total 20
drwxr-xr-x   2 root root 4096 Aug 29 01:46 .
drwxr-xr-x 106 root root 4096 Aug 29 07:58 ..
-rw-r--r--   1 root root   50 Aug 29 00:45 havi

$:/etc/vsftpd_user_conf# vi havi
local_root=/var/www/shark5060.net/.sub-user/havi/

however, unless the user is in the vsftpd.chroot_list they cannot login (FlashFXP just says something about "connection closed by host" and WinSCP is not very helpful, see logs below). vsftp.log shows a successful login:

$:/etc/log/# vi vsftpd.log
Thu Aug 29 01:46:35 2019 [pid 2772] CONNECT: Client "::ffff:93.204.74.253"
Thu Aug 29 01:46:35 2019 [pid 2771] [shark5060] OK LOGIN: Client "::ffff:93.204.74.253"
Thu Aug 29 01:46:37 2019 [pid 2772] [shark5060] DEBUG: Client "::ffff:93.204.74.253", "Control connection terminated without SSL shutdown."
Thu Aug 29 01:46:32 2019 [pid 2761] CONNECT: Client "::ffff:93.204.74.253"
Thu Aug 29 01:46:32 2019 [pid 2760] [havi] OK LOGIN: Client "::ffff:93.204.74.253"

but if we take a look at the winscp.log it looks like this:

https://pastebin.com/XpQvNCNJ (due to length)

exactly the same setup, just that the user is in the vsftpd.chroot_list (used admin user for this log, but works the same with the other user)

https://pastebin.com/ydsGux5N (due to length)

so it's safe to say that the winSCP log is not very helpful. I wonder why the user is not able to login though. He has read and write access to the directory (through group permission) and CAN login once he's no longer chrooted. Did I miss something or have I misunderstood a configuration setting? I basically just want to have users to only have access to directory x and one admin user who can access it all.

Thank you.

EDIT:

Some additional information. I've tried around with different possibilities to jail users to their home directory.

Current configuration

usermod -d /var/ftp/havi/ havi
mount --bind /var/www/shark5060.net/.sub-user/havi/ /var/ftp/havi/

also removed the user_config_files for this user.

it works, but only as long as a) the user is still in the chroot allowed list and b) the /var/ftp/ directory is at least chmod xx1 (751 for example), 750 does not work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.