I am trying to setup my vsftpd server to give users access to certain parts of the homepage. Specifically they have access to one directory in the "user" subdomain.
I give you examples with 2 users. shark5060 = admin, havi = user
the whole /var/www/ directory is owned by www-data:www-ftp (including all files and subdirs)
$:/var/www/shark5060.net/.sub-user# ls -al total 88 drwxrwxr-x 16 www-data www-ftp 4096 Aug 1 23:16 . drwxrwxr-x 16 www-data www-ftp 4096 Aug 28 02:28 .. drwxrwxr-x 6 www-data www-ftp 4096 Aug 1 23:08 havi
the ftp users have www-ftp as their main group
$:/home/shark5060# id shark5060 uid=1000(shark5060) gid=1002(www-ftp) groups=1002(www-ftp),27(sudo),1000(shark5060) $:/home/shark5060# id havi uid=1004(havi) gid=1002(www-ftp) groups=1002(www-ftp),1005(havi)
here is the configuration of my vsftpd server (only relevant parts)
$:/etc# vi vsftpd.conf anonymous_enable=NO local_enable=YES #keep users in their home dir chroot_local_user=YES #except those in this list chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list #only let those users login userlist_enable=YES userlist_file=/etc/vsftpd.user_list userlist_deny=NO #config for each user user_config_dir=/etc/vsftpd_user_conf #SSL rsa_cert_file=/etc/ssl/certs/shark5060.net.cer rsa_private_key_file=/etc/ssl/private/shark5060.net.key ssl_enable=YES allow_anon_ssl=NO force_local_data_ssl=YES force_local_logins_ssl=YES ssl_tlsv1=YES ssl_sslv2=NO ssl_sslv3=NO require_ssl_reuse=NO ssl_ciphers=HIGH
vafptd.user_list contains all users and the admin
$:/etc# vi vsftpd.user_list shark5060 havi
vsftpd.chroot_list only contains the admin, because he should have access to everything
root@v22019027804982723:/etc# vi vsftpd.chroot_list shark5060
the vsfptd_user_config dir contains only user files, which all have the setup for the dir they can access.
$:/etc# cd vsftpd_user_conf/ $:/etc/vsftpd_user_conf# ls -al total 20 drwxr-xr-x 2 root root 4096 Aug 29 01:46 . drwxr-xr-x 106 root root 4096 Aug 29 07:58 .. -rw-r--r-- 1 root root 50 Aug 29 00:45 havi $:/etc/vsftpd_user_conf# vi havi local_root=/var/www/shark5060.net/.sub-user/havi/
however, unless the user is in the vsftpd.chroot_list they cannot login (FlashFXP just says something about "connection closed by host" and WinSCP is not very helpful, see logs below). vsftp.log shows a successful login:
$:/etc/log/# vi vsftpd.log Thu Aug 29 01:46:35 2019 [pid 2772] CONNECT: Client "::ffff:18.104.22.168" Thu Aug 29 01:46:35 2019 [pid 2771] [shark5060] OK LOGIN: Client "::ffff:22.214.171.124" Thu Aug 29 01:46:37 2019 [pid 2772] [shark5060] DEBUG: Client "::ffff:126.96.36.199", "Control connection terminated without SSL shutdown." Thu Aug 29 01:46:32 2019 [pid 2761] CONNECT: Client "::ffff:188.8.131.52" Thu Aug 29 01:46:32 2019 [pid 2760] [havi] OK LOGIN: Client "::ffff:184.108.40.206"
but if we take a look at the winscp.log it looks like this:
https://pastebin.com/XpQvNCNJ (due to length)
exactly the same setup, just that the user is in the vsftpd.chroot_list (used admin user for this log, but works the same with the other user)
https://pastebin.com/ydsGux5N (due to length)
so it's safe to say that the winSCP log is not very helpful. I wonder why the user is not able to login though. He has read and write access to the directory (through group permission) and CAN login once he's no longer chrooted. Did I miss something or have I misunderstood a configuration setting? I basically just want to have users to only have access to directory x and one admin user who can access it all.
Some additional information. I've tried around with different possibilities to jail users to their home directory.
usermod -d /var/ftp/havi/ havi
mount --bind /var/www/shark5060.net/.sub-user/havi/ /var/ftp/havi/
also removed the user_config_files for this user.
it works, but only as long as a) the user is still in the chroot allowed list and b) the /var/ftp/ directory is at least chmod xx1 (751 for example), 750 does not work.