1

I hope I'm asking this question on the right stack site.

I can easily create a new system user in bash by logging in as root. But I know that cPanel "likes" you to use their interface to do things, whenever possible. I also don't necessarily want to create a system user account... I think it would be better to limit the new "user" to FTP access to certain folders.

In the cpanel interface for an account, you can create additional FTP users, but they are limited to their own folder. Is there any way to create an FTP user in cpanel/WHM who can upload/download the website files under the /home/[system_user]/public_html folder?

I think it would be ideal to have several users with permission to access those files, without necessarily creating full-fledged system users with their own home/[username]/ folders.

Is there any way to do that in cPanel/WHM?

Improve this question

1 Answer 1

Reset to default
0

You have just described cPanel's exact behavior in cPanel » Files » FTP Accounts. Multiple FTP accounts (which are not full system accounts) can be created to have the same home folder, as you can see in this screenshot:

[Screenshot of cPanel » Files » FTP Accounts

Security Note

Allowing multiple FTP users access to a document root also allows any of those users to upload a shell to "break out" of the document root and manipulate any files owned by the account.

Improve this answer
3
  • "You have just described cPanel's exact behavior in cPanel » Files » FTP Accounts. " I know! That's why I said "In the cpanel interface for an account, you can create additional FTP users, but they are limited to their own folder." I managed to get the functionality I wanted by using mount --bind /home/[system_user]/public_html/resources/javascript /home/[system_user]/public_html/chrooted_ftp_account/www_javascript. Now the ftp user only has access to his chrooted folder AND the js files I want him to edit!
    – Buttle Butkus
    Commented Jan 19, 2015 at 3:31
  • But are you saying he could upload something into the "javascript" folder that would allow him to break further out?
    – Buttle Butkus
    Commented Jan 19, 2015 at 3:31
  • Yes, @ButtleButkus, a PHP shell could be uploaded there, which would allow the person using the FTP account to access essentially everything owned by [system_user], including under /home/[system_user]. The solution you proposed is not any more secure, since what is put under public_html can run a shell.
    – Deltik
    Commented Jan 19, 2015 at 3:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .